Frequently asked questions for five CVEs affecting Ivanti Connect Secure and Policy Secure Gateways, with three of the vulnerabilities having been exploited in the wild as zero-days.

CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893: Frequently Asked Questions for Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

UNC5325, a suspected Chinese cyber espionage operator, has exploited CVE-2024-21893 to deploy a variety of malware. Organizations are encouraged to patch as soon as possible.

Mass exploitation has been observed and an increase in attacks has continued with attackers abusing the vulnerability to install the DSLog backdoor

Mass exploitation has been observed for all three of these CVEs and an increase in attacks has spiked starting on Feb. 2 around the time a PoC was released for CVE-2024-21893.

Exploit details for CVE-2024-21893, an authentication bypass in Ivanti Connect Secure is now public. Combined with in-the-wild exploitation, apply patches as soon as possible.

Exploitation of CVE-2024-21893 has been observed alongside CVE-2023-46805 and CVE-2024-21887. With patches still rolling out, mitigations should be applied as soon as possible

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ivanti Connect Secure 9.x, 22.x suffers from a Server-Side Request Forgery.

By crafting a specific HTTP request, a remote attacker could exploit this vulnerability to access certain restricted resources without authentication.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by a server-side request forgery vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) which allows an unauthenticated attacker to send specially crafted requests to cause unauthorized command executions. This vulnerability can be exploited over the internet.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by a server-side request forgery vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) which allows an unauthenticated attacker to send specially crafted requests and have the server interact with untrusted, insecure systems. This vulnerability can be exploited over the internet.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by a server-side request forgery vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) which allows an unauthenticated attacker to send specially crafted requests and have the server interact with untrusted, insecure systems. This vulnerability can be exploited over the internet.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by a server-side request forgery vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) which allows an unauthenticated attacker to send specially crafted requests to cause unauthorized command executions. This vulnerability can be exploited over the internet.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
190367	Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	Remote	critical
114196	Ivanti Connect Secure 9.x / 22.x Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Check Based	critical
190063	Ivanti Connect Secure 9.x / 22.x SSRF-RCE Chain (CVE-2024-21893)	Nessus	CGI abuses	Remote	high
190062	Ivanti Connect Secure 9.x / 22.x SSRF (CVE-2024-21893)	Nessus	CGI abuses	Remote	high
190061	Ivanti Policy Secure 9.x / 22.x SSRF (CVE-2024-21893)	Nessus	CGI abuses	Remote	high
190060	Ivanti Policy Secure 9.x / 22.x SSRF-RCE Chain (CVE-2024-21893)	Nessus	CGI abuses	Remote	high
187908	Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2024-21893

critical

Tenable Plugins

critical

critical

high

high

high

high

critical