Citrix, VDI & remote-access penetration testing

// 01 Why these gateways are a prime target

Citrix, VDI and remote-access gateways sit at the boundary between the internet and the internal network, giving remote users access to internal desktops and applications. That position makes them extremely attractive to attackers: a single vulnerability in an internet-facing gateway can provide a direct route into the internal environment, and several high-profile vulnerabilities in these products have been actively exploited to gain initial access. Because they're exposed to the internet by design, always reachable, and act as a gateway to internal systems, compromising one can bypass much of the perimeter and place an attacker inside the network. That's why they need to be tested and patched with particular urgency - they're among the highest-value targets on the external attack surface, and a favourite pivot point toward the domain.

// 02 The two dominant risks

The first risk is vulnerabilities in the gateway or access product itself - flaws allowing an attacker to bypass authentication, execute code, or otherwise gain access from the internet, which is why keeping these products patched is critical. The second is session or virtual-desktop breakout: a user with legitimate access to a published application or virtual desktop escapes the intended restricted environment to reach the underlying operating system, other applications, or the wider network - turning limited access into broad access. Alongside sit authentication weaknesses (missing MFA) and misconfigurations that grant more access than intended.

// 03 What a test covers & what a breakout is

A test covers two directions. Getting in from the outside: the internet-facing gateway and its exposure - known and configuration vulnerabilities, authentication strength, and whether MFA is enforced. Breaking out from within: the security of the virtual desktop or published-application environment from the perspective of a user who has logged in. This breakout testing examines whether a user restricted to a specific application or locked-down desktop can escape to the underlying OS, launch unauthorised tools, access files and drives they shouldn't, or pivot into the internal network. A breakout is exactly that escape: a kiosk-style session meant to run one business app gets manipulated - through dialog boxes, file operations, keyboard shortcuts or other techniques - into launching a command prompt, browsing the file system, or reaching internal resources the user was never meant to touch. Because VDI and Citrix are frequently used to give contractors, third parties or remote staff limited access, a breakout can turn deliberately limited access into a foothold on the internal network - which is why it's a core focus. Breakout testing deliberately attempts these escapes to prove whether the intended isolation actually holds.

// 04 How an engagement runs

A Citrix/VDI engagement typically runs in two phases mirroring the two risks. First, an external assessment of the gateway: version and patch state against known exploited vulnerabilities, configuration, and authentication/MFA enforcement. Second, an authenticated breakout assessment: we're given a standard restricted session - the same locked-down app or desktop a contractor or remote worker would get - and attempt to escape it, escalate, and pivot, exactly as a malicious or compromised user would. Findings are prioritised - gateway RCE and successful breakouts first - written into a remediation plan, and retested to closure. Where the environment feeds a wider network, we map the onward attack paths. It slots into a broader external and internal programme and follows our methodology. Scope both the gateway and a representative locked-down session up front, per our scoping guide.

// 05 Frequently asked questions

// 06 Related reading

• External vs internal testing — where gateways sit on the attack surface.
• Active Directory attack paths — the onward pivot after a breakout.
• Scoping a test and the remediation plan.