CVEs Explained — How to Understand Them and What

Organizations rely on Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways to provide secure remote access. A critical flaw, CVE-2023-46805, exposes these systems to unauthenticated attackers. This vulnerability, an authentication bypass, allows remote threat actors to circumvent security controls and access restricted resources on affected appliances. This deep dive into CVE-2023-46805 explores the technical underpinnings and detection strategies.

Deep Dive into CVE-2023-46805: What the Vulnerability Is and Its Impact

CVE-2023-46805 is an authentication bypass vulnerability affecting the web component of Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways. This flaw enables a remote attacker to gain access to restricted resources without valid credentials. The National Vulnerability Database (NVD) assigned CVE-2023-46805 a CVSS v3.1 score of 8.2, categorizing it as High severity (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). It impacts all supported versions of Ivanti Connect Secure and Ivanti Policy Secure, including 9.x and 22.x.

The immediate impact of CVE-2023-46805 is unauthorized access to sensitive parts of the VPN gateway's web interface. While it does not grant direct code execution, it serves as a critical precursor, often chained with other vulnerabilities. Notably, it has been widely exploited in conjunction with CVE-2024-21887, a command injection vulnerability. This combination allows unauthenticated attackers to execute arbitrary commands with elevated privileges, leading to full system compromise, data exfiltration, and persistent access.

Technical Root Cause Analysis

The root cause of CVE-2023-46805 lies in improper validation of authentication tokens and manipulated URI paths within the Ivanti appliance's web interface. The vulnerability is essentially a path traversal issue. Attackers craft specific HTTP requests that exploit how the web server processes URLs, allowing them to bypass authentication checks that would normally protect administrative or restricted endpoints. The system fails to correctly normalize or validate the incoming URL paths, enabling an attacker to reference resources outside the intended authenticated directory structure.

Ivanti Connect Secure appliances utilize a custom web server written in C++. This server's logic for enforcing access controls is where the flaw exists. By inserting specific sequences into the URI, such as /dana-na/../dana-na/, an attacker can trick the system into routing a request to an unauthenticated handler while still appearing to target an authenticated path. This misdirection allows the attacker to reach internal API endpoints or configuration pages that should only be accessible post-authentication.

Exploitation Mechanics

Exploiting CVE-2023-46805 involves sending a specially crafted HTTP GET request to the vulnerable Ivanti gateway. An attacker manipulates the URI to bypass the authentication mechanism. The core technique uses path traversal characters (..%2f or ../) within the URL to access restricted resources. This allows access to internal endpoints without needing a valid session token or credentials.

For instance, an attacker might target an endpoint like /api/v1/license/keys by crafting a request that includes the traversal sequence. A typical unauthenticated request for a sensitive resource would be denied. However, by inserting the bypass, the web server processes it differently.

GET /dana-na/../dana-na/api/v1/license/keys HTTP/1.1
Host: [VULNERABLE_IVANTI_HOST]
User-Agent: Mozilla/5.0
Accept: /

This request, while appearing to navigate within the /dana-na/ context, effectively traverses up and then back down to the /api/v1/license/keys endpoint, which is not intended for unauthenticated access. Successfully exploiting this vulnerability grants an attacker the ability to enumerate system information, access configuration details, or prepare for further compromise by chaining it with other vulnerabilities like CVE-2024-21887, which allows for remote code execution. The combination of these flaws presents a severe threat, as it permits unauthenticated command injection on the appliance.

Detection: How to Check if You're Affected

Detecting CVE-2023-46805 requires vigilance and specific checks. Organizations should first identify all Ivanti Connect Secure and Ivanti Policy Secure instances within their network. An external Secably free port scanner can help identify internet-exposed Ivanti appliances by looking for common VPN ports (e.g., TCP/443). Additionally, tools like Zondex can perform internet-wide scanning to locate exposed services, including Ivanti gateways.

Once identified, check the appliance's version against Ivanti's official advisories. All supported versions 9.x and 22.x are affected prior to patching. Review system logs for unusual access patterns, especially to administrative or API endpoints that typically require authentication. Look for requests containing path traversal sequences (e.g., ../ or URL-encoded ..%2f) targeting restricted paths.

Ivanti provides an External Integrity Checker Tool (ICT) which can help detect compromise, though early versions had limitations and could be deceived by sophisticated threat actors. It is crucial to use the latest version of the ICT after applying patches, as older versions may generate false positives or fail to detect compromise on previously unpatched systems. Organizations can also use a free website vulnerability scanner from Secably to probe Ivanti web interfaces for known indicators of this vulnerability, although manual verification of specific HTTP responses is often necessary for definitive confirmation.

Suspicious log entries might include:

• Repeated access attempts to sensitive URIs (e.g., /api/v1/, /admin/) from unauthenticated sources.
• HTTP requests with malformed or unusual URI paths containing traversal sequences.
• Unexpected process spawning or file modifications, particularly if CVE-2024-21887 was chained.

A HTTP security headers checker can also provide insights into the general security posture of the web component, though it won't directly detect this specific authentication bypass. For a deeper analysis of the underlying technologies, a technology stack detector can identify the web server and related components, aiding in understanding the attack surface.

Remediation Steps

Immediate remediation for CVE-2023-46805 requires applying the vendor-provided patches. Ivanti released patches for all affected versions of Connect Secure and Policy Secure. Organizations must prioritize updating their appliances to the latest secure versions. For Ivanti Connect Secure, this includes versions 9.1R18.4, 9.1R17.3, 9.1R16.3, 9.1R15.3, 9.1R14.5, 22.6R2.2, 22.5R2.3, 22.5R1.2, 22.4R2.3, 22.4R1.1, and 22.3R1.1, among others.

If immediate patching is not feasible, Ivanti provided mitigation steps in the form of an XML file that administrators could import to block exploitation. This mitigation should be considered temporary; it does not replace the need for full patching. It is critical to ensure any temporary mitigation is correctly applied and remains active. Pushing new configurations while a mitigation is active can disable it, leaving the appliance vulnerable again.

Beyond patching, implement additional security measures. Enforce multi-factor authentication (MFA) for all administrative interfaces and user VPN access. Segment networks to limit the blast radius of a compromised VPN appliance. Regularly review and terminate suspicious active sessions. Consider migrating to Ivanti Neurons for ZTA for improved architecture and security. For detailed guidance on similar vulnerabilities, refer to resources like Patching Unauthenticated File Read Vulnerabilities in At.

Timeline of Disclosure

The timeline surrounding CVE-2023-46805 highlights its severity and the rapid response required:

• December 2023: Security researchers at Volexity observed active exploitation of what would become CVE-2023-46805 and CVE-2024-21887 in the wild, prior to public disclosure. This indicated zero-day exploitation by sophisticated threat actors.
• January 10, 2024: Ivanti publicly disclosed CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection). They released a security advisory detailing the vulnerabilities and provided interim mitigation steps.
• January 11, 2024: CISA added CVE-2023-46805 and CVE-2024-21887 to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing their active exploitation and critical nature.
• January 16, 2024: Widespread scanning and exploitation attempts targeting Ivanti Connect Secure appliances surged after full exploit details became public.
• January 22 - February 19, 2024: Ivanti began releasing patches for affected versions of Ivanti Connect Secure and Policy Secure, with a phased rollout.
• January 31, 2024: Ivanti disclosed additional vulnerabilities (CVE-2024-21888 and CVE-2024-21893) and updated their advisory. CISA issued a supplemental directive, urging federal agencies to disconnect Ivanti Connect Secure and Policy Secure products if not patched by February 2, 2024.
• February 8, 2024: Ivanti announced a fifth vulnerability, CVE-2024-22024, an XML external entity (XXE) flaw, and released further patches.
• February 29, 2024: CISA issued a joint cybersecurity advisory, noting that Ivanti's integrity checker tools could be deceived and that threat actors might maintain root-level persistence even after factory resets.