Ivanti Connect Secure Auth Bypass + Command Injection
- Product
- Ivanti Connect Secure / Policy Secure
- CVE
- CVE-2023-46805CVE-2024-21887
- Disclosed
- 2024-01-10
- CVSS
- 9.1
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Ivanti Connect Secure and Policy Secure 9.x and 22.x.
- Fixed
- Patches released from 2024-01-31 (e.g. ICS 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, 22.5R2.2); mitigation XML before that.
Summary
Volexity discovered a China-nexus actor chaining an authentication bypass and a command injection in Ivanti Connect Secure VPNs. After public analysis, mass exploitation followed and CISA issued an emergency directive ordering federal agencies to disconnect affected devices.
Root cause
CVE-2023-46805: a path traversal in the REST API lets requests that start with an unauthenticated prefix reach restricted endpoints. CVE-2024-21887: several of those endpoints pass request path or body values into shell commands without sanitization, giving command execution as root.
Impact
Unauthenticated root code execution, credential harvesting and persistent implants on the VPN.
Detection
Run Ivanti's Integrity Checker Tool (external version), look for '/api/v1/totp/user-backup-code/../' in logs, and check for modified files. Nuclei templates exist for both CVEs.
Mitigation
Apply patches, factory-reset compromised devices, and rotate credentials and certificates.