Citrix ShareFile Storage Zones Controller CVE-2023-24489 (unauthenticated compromise of customer-managed storage zones, CISA KEV): which version fixes it?

What it is: CVE-2023-24489 is an improper access control flaw in the customer-managed ShareFile storage zones controller (Citrix Content Collaboration) that lets an unauthenticated remote attacker compromise the controller. It was published July 10, 2023, scored 9.8 by NVD, and CISA added it to the KEV catalog on August 16, 2023 after exploitation was observed. Am I affected: - Customer-managed ShareFile Storage Zones Controller, all versions before 5.11.24 (per NVD). The cloud-hosted ShareFile service is not the customer-managed controller. - Check the controller version on each storage zones server. Fix: 1. Upgrade the storage zones controller to 5.11.24 or later, and keep it on a currently supported release. The Citrix advisory number is CTX559517; consult it through your Citrix account if reachable. 2. Limit exposure: place the controller behind a reverse proxy or WAF where possible and restrict administration paths to trusted networks. 3. If an unpatched controller was internet-facing, treat it as potentially compromised: look for unfamiliar files or web shells in the application directory, unexpected processes or outbound connections, and unusual file access or downloads in the storage zone logs. Rebuild from a clean image, restore from a known-good backup, and rotate credentials, keys and service accounts used by the controller and any storage it can reach. Verify: the controller reports 5.11.24 or later and the application directories contain only expected files. Sources: https://nvd.nist.gov/vuln/detail/CVE-2023-24489 https://www.cisa.gov/known-exploited-vulnerabilities-catalog