Ivanti Connect Secure command injection

What it does

A command injection in the web components of Ivanti Connect Secure allows an authenticated administrator to execute arbitrary commands on the appliance.

In practice it is chained with CVE-2023-46805, an authentication bypass, so that no credentials are required. The pair was exploited as a zero-day by a suspected China-nexus actor to deploy web shells and harvest credentials.

Ivanti's initial mitigation XML was itself bypassed, and later patches required a factory reset before installation.

Remediation

1. Apply the latest Ivanti patch for your release train and perform the factory reset Ivanti recommends before patching.
2. Run the external Integrity Checker Tool; the internal ICT was shown to be unreliable on compromised appliances.
3. Rotate any secrets stored on or passing through the appliance, including domain credentials used for LDAP binds.

Enumeration

Detection templates and scanners you can run to find exposed instances on your own attack surface.

$ nuclei -id CVE-2024-21887 -u https://TARGET

Exploitation

Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.

$ msfconsole -q -x "use exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805; show options"

References

• Ivanti advisory KB CVE-2023-46805 / CVE-2024-21887forums.ivanti.com
• CISA emergency directive ED 24-01www.cisa.gov
• NVD recordnvd.nist.gov