CVE-2019-13608: Citrix StoreFront Server XXE allows unauthenticated file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is remotely exploitable without authentication, listed in CISA KEV with known ransomware use, and carries a high confidentiality impact.

What it is

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) is vulnerable to XML External Entity (XXE) processing (CWE-611). An attacker can submit crafted XML that causes the server to resolve external entities, exposing data the server process can read. The flaw is remotely reachable without authentication or user interaction, and CISA lists it as known exploited.

Impact

An attacker gains read access to files and resources reachable by the StoreFront server process, which can expose configuration data, credentials or other sensitive content. The CVSS vector rates confidentiality as high with no integrity or availability impact.

Attack surface

Reachable over the network via the StoreFront web interface (AV:N, PR:N, UI:N), so no credentials or user interaction are required. Any XML-accepting endpoint that parses attacker-supplied input is a candidate entry point.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with a 2022-05-03 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is 0.30041 (98th percentile). The record does not state whether public exploit code exists.

What to do

• Upgrade to StoreFront 1903 or later, or to 7.15 LTSR CU4 (3.12.4000) / 7.6 LTSR CU8 (3.0.8000) or later, per Citrix advisory CTX251988.
• If immediate patching is not possible, apply the mitigations in CTX251988 and restrict network access to StoreFront endpoints to trusted sources.
• Disable external entity and DTD processing in XML parsers where the application allows configuration.
• Treat StoreFront hosts as compromised-priority assets: rotate credentials and secrets that the service account could read.
• Monitor for and block XML payloads containing DOCTYPE or ENTITY declarations at the perimeter or WAF.

Detection

• Search web and proxy logs for POST or PUT requests with XML bodies containing DOCTYPE, ENTITY, SYSTEM or file:// strings to StoreFront URLs.
• Alert on outbound connections from StoreFront servers to unexpected internal or external hosts, which may indicate entity resolution or exfiltration.
• Review StoreFront server file access and process telemetry for reads of sensitive files (configuration, key stores, credential files) by the web service account.
• Correlate StoreFront host activity with CISA KEV timelines and check for signs of ransomware staging on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.