Ivanti Cloud Services Appliance Path Traversal + Command Injection
- Product
- Ivanti Cloud Services Appliance (CSA) 4.6
- CVE
- CVE-2024-8963CVE-2024-8190
- Disclosed
- 2024-09-19
- CVSS
- 9.1
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Ivanti CSA 4.6 before Patch 519 (CSA 4.6 was end-of-life).
- Fixed
- CSA 4.6 Patch 519; CSA 5.0.
Summary
A path traversal in the end-of-life Ivanti CSA 4.6 let unauthenticated attackers reach restricted admin functionality, which they chained with an authenticated OS command injection for RCE. Fortinet and Ivanti observed limited zero-day exploitation.
Root cause
CVE-2024-8963: URL path handling allowed traversal into protected admin PHP pages without authentication. CVE-2024-8190: a time-zone setting parameter in the admin interface was passed to a shell command unsanitized.
Impact
Unauthenticated remote code execution on the appliance and credential theft.
Detection
Check for unexpected admin users, review web logs for traversal requests to /gsb/ pages, and version-check for Patch 519.
Mitigation
Upgrade to CSA 5.0 (4.6 is EOL) and rotate credentials.