CVE-20 Explained — What You Need to

Unpacking CVE-20

This analysis focuses on Unpacking CVE-20, specifically CVE-2023-46805, an authentication bypass vulnerability affecting Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways. This flaw allows unauthenticated attackers to bypass authentication on the web server. It carries a CVSS v3.1 base score of 8.2 (High). All supported versions of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (22.x) are vulnerable. Attackers often chain this bypass with CVE-2024-21887, a command injection vulnerability, to achieve remote code execution (RCE).

What the Vulnerability Is and Its Impact

CVE-2023-46805 is an authentication bypass vulnerability. It impacts Ivanti Connect Secure versions 9.x and 22.x, as well as Ivanti Policy Secure 22.x. This flaw allows an unauthenticated attacker to access restricted resources by manipulating URL paths. The vulnerability does not require any credentials. Its high severity arises from its common chaining with CVE-2024-21887, a command injection flaw, enabling unauthenticated RCE. The combined impact is critical for organizations using these Ivanti products.

The CVSS v3.1 score for CVE-2023-46805 is 8.2 (High), categorized as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. This indicates network-based attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality with low impact on integrity and no impact on availability. When chained with CVE-2024-21887, the combined exploit achieves a CVSS v3.1 score of 9.1 (Critical). Ivanti published details in their security advisory KB44755.

Technical Root Cause Analysis

The root cause for CVE-2023-46805 lies within how the Ivanti Connect Secure web server handles URL requests. Specifically, the vulnerability resides in the /dana-na/auth/url_default/ endpoint. The Ivanti Connect Secure appliance uses a component called 'Perl CGI' for handling web requests. A misconfiguration or flaw in how this Perl CGI script processes specially crafted URLs allows an attacker to bypass authentication.

The core issue involves path traversal and improper validation of URL components. The system incorrectly processes certain encoded characters or directory traversal sequences (e.g., ../) within the URL path. This allows an authenticated attacker to access restricted internal web application endpoints without proper authorization checks. For instance, by appending specific paths after an authenticated endpoint, an attacker can trick the server into believing the request is authorized, even if no session exists. This flaw essentially opens a backdoor to internal API endpoints that should only be accessible post-authentication.

Exploitation Mechanics

Exploitation of CVE-2023-46805 typically involves chaining it with CVE-2024-21887 for full remote code execution. An attacker first leverages the authentication bypass (CVE-2023-46805) to gain access to a restricted Ivanti Connect Secure endpoint, such as /api/v1/license/keys-status/ or /api/v1/configuration/users/. This access is gained without valid credentials.

Once authenticated access is achieved via CVE-2023-46805, the attacker then exploits CVE-2024-21887. This command injection vulnerability exists within multiple web components of the Ivanti Connect Secure and Policy Secure gateways. By sending a crafted POST request to an exposed API endpoint, an attacker can inject arbitrary commands. For example, specific API endpoints that handle configuration updates or system queries can be coerced into executing commands on the underlying operating system. This allows attackers to establish persistent access, deploy web shells, or exfiltrate data.

A common exploit chain looks like this:

1. An unauthenticated attacker sends a GET request to a manipulated URL, such as /dana-na/auth/url_default/welcome.cgi/dana/byepass/tenant_settings.thtml, using the authentication bypass.
2. This bypass grants access to an internal API endpoint.
3. The attacker then sends a POST request to an API endpoint vulnerable to command injection (CVE-2024-21887), for example, /api/v1/license/keys-status/ with a specially crafted JSON payload containing system commands.
4. The Ivanti appliance executes the injected commands with elevated privileges.

This sequence provides unauthenticated remote code execution. Mandiant observed this exploitation in the wild as early as December 2023. The attackers used this access to deploy custom malware, including web shells and passive backdoors.

Detection: How to Check If You're Affected

Organizations must actively check their Ivanti Connect Secure and Policy Secure deployments. First, identify all internet-facing Ivanti appliances. Use a free port scanner to check for open ports (e.g., 443) on your perimeter. A Zondex scan can also identify exposed Ivanti instances across your attack surface.

Examine Ivanti logs for suspicious activity. Look for unusual requests to /dana-na/auth/url_default/ or /api/v1/ endpoints from unauthenticated sources. Indicators of Compromise (IoCs) include specific file modifications, unexpected processes, and outbound connections to unknown IP addresses. Ivanti provided an external ICT tool for checking for compromise.

Check for the presence of specific files or directories that indicate compromise. Mandiant and Ivanti released IoCs, including filenames like /tmp/s.py, /tmp/kill.sh, and web shells in various Ivanti directories. You can use a free website vulnerability scanner to look for unexpected files or altered responses on public-facing Ivanti web interfaces. Secably's technology stack detector can confirm if your public assets are running Ivanti products.

Network defenders should monitor outbound traffic from Ivanti appliances for connections to suspicious IP addresses or domains. Look for unusual DNS queries or data exfiltration attempts. This is especially important for Unpacking CVE-20, as post-exploitation activities often involve command and control communications.

Remediation Steps

Immediate remediation for CVE-2023-46805 and CVE-2024-21887 involves applying the latest security updates from Ivanti. Ivanti released patches in stages, starting with out-of-band updates and then consolidated releases. The recommended action is to upgrade to an unaffected version.

Ivanti provided specific patch versions:

• Ivanti Connect Secure: 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.5R1.1, 22.5R2.2, 22.6R1.1, 22.6R1.2 (for 22.6R1).
• Ivanti Policy Secure: 22.5R1.1, 22.5R2.2.
• Ivanti ZTA: 22.6R1.3.

If immediate patching is not feasible, Ivanti provided XML mitigation files. These files must be imported into the Ivanti appliance to implement temporary protections. However, these mitigations are not a substitute for full patching. Ensure you follow Ivanti's instructions precisely for applying these XML files.

After patching or applying mitigations, perform a factory reset and re-image the appliance. This ensures all persistent threats are removed. Do not simply patch over an already compromised system. Then, restore configuration from a known-good backup. Rotate all credentials associated with the Ivanti appliance, including administrative accounts and any integrated services.

Consider network segmentation for your Ivanti appliances. Isolate them from critical internal networks. Implement strict firewall rules to limit outbound connectivity to only essential services. Regularly scan your external attack surface using tools like Secably's paid monitoring plans, starting at $19/month, to detect new exposures or re-emergence of vulnerabilities. Secably also offers a free tier for instant tools without signup.

Timeline of Disclosure

The timeline for Unpacking CVE-20 (CVE-2023-46805 and CVE-2024-21887) involved a period of silent exploitation before public disclosure.

• December 2023: Mandiant first observed exploitation of CVE-2023-46805 and CVE-2024-21887 in the wild, affecting a limited number of Ivanti customers.
• January 10, 2024: Ivanti publicly disclosed the vulnerabilities (CVE-2023-46805 and CVE-2024-21887) and released initial mitigation guidance via XML files.
• January 23, 2024: Ivanti released the first set of security patches for specific versions of Ivanti Connect Secure.
• February 2024: Ivanti continued to release additional patches and provided further guidance as more vulnerabilities (e.g., CVE-2024-21888, CVE-2024-21893) were discovered and chained.
• Throughout February and March 2024: Multiple security vendors, including CISA, Mandiant, and Volexity, released detailed analyses and IoCs, confirming widespread exploitation by various threat actors.

This timeline highlights the critical nature of these vulnerabilities and the rapid response required from both the vendor and affected organizations. The initial exploitation occurred before public disclosure, emphasizing the need for proactive threat hunting.