Preface: The secure access solution from Citrix provides a unified stack of cloud-delivered services that allows IT to provide a productive hybrid work environment with zero trust security.

Background: Citrix Secure Access client for Linux is a VPN client software managed by NetScaler Gateway that enables users to access corporate data and applications remotely. It protects applications from unauthorized access, application-level threats, and browser-based attacks.
Ref: If the HttpOnly attribute is set on a cookie, then the cookie’s value cannot be read or set by client side JavaScript. This measure makes certain client side attacks, such as cross-site scripting, slightly harder to exploit by preventing them from trivially capturing the cookie’s value via an injected script.

Vulnerability details: Vulnerabilities have been discovered in Citrix Secure Access client for Ubuntu (previously Citrix Gateway VPN client for Ubuntu). 
If exploited, could allow an attacker to remotely execute code if a victim user opens an attacker-crafted link and accepts further prompts.
The following supported versions are affected by the vulnerability: Versions before 23.5.2
Ref: The Citrix Secure Access and Citrix EPA clients support the HTTPOnly flag on the  authentication cookies.
NetScaler Gateway admins configure the HTTPOnly feature on the authentication cookie that are generated by web applications. This feature help in preventing cookie theft due to cross site scripting .

Official announcement:For details, please refer to the link – https://support.citrix.com/article/CTX564169/citrix-secure-access-client-for-ubuntu-security-bulletin-for-cve202324492