Deep Dive into Actively Exploited Vulnerabilities

Technical Analysis of the Actively Exploited Ivanti Vulnerabilities

This technical analysis focuses on the actively exploited vulnerabilities, CVE-2023-46805 and CVE-2024-21887, affecting Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways. These critical flaws allow unauthenticated remote code execution (RCE) when chained. Attackers bypass authentication and then execute arbitrary commands on vulnerable appliances.

Vulnerability Overview and Impact

CVE-2023-46805 is an authentication bypass vulnerability within the web component of Ivanti Connect Secure and Policy Secure. It carries a CVSS score of 8.2 (High). This flaw allows unauthenticated access to restricted resources. CVE-2024-21887 is a command injection vulnerability, also in the web component, with a CVSS score of 9.1 (Critical). When combined, these vulnerabilities enable an unauthenticated attacker to execute arbitrary commands on the appliance. Affected versions include Ivanti Connect Secure versions 9.x and 22.x, and Ivanti Policy Secure.

Technical Root Cause Analysis

The root cause of CVE-2023-46805, the authentication bypass, lies in how the Ivanti Connect Secure web server framework processes certain specially crafted HTTP requests. Specifically, a flaw in the `handle_request` function within the `web.py` component allowed attackers to bypass session validation by manipulating URI paths. This permitted access to internal API endpoints that should have required prior authentication. The system failed to properly neutralize special elements in the URI, leading to unauthorized access. CVE-2024-21887, the command injection vulnerability, originates from improper input sanitization when processing user-supplied data in various XML files and API endpoints. Mandiant's analysis indicated that the `set_state` function within `web.py` was vulnerable. Attackers could inject arbitrary commands into specific XML nodes or parameters, such as the `state` parameter in the `/api/v1/license/usage` endpoint. The system then executed these commands without sufficient validation, allowing for arbitrary command execution.

Exploitation Mechanics

Exploitation of these vulnerabilities begins with the authentication bypass, CVE-2023-46805. An attacker sends a crafted HTTP GET request to a vulnerable Ivanti appliance. This request exploits the URI processing flaw to gain unauthenticated access to internal API endpoints, effectively bypassing the login page.

GET /api/v1/license/usage/asset-params?state=%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
Host: [VULNERABLE_IVANTI_IP]

After successfully bypassing authentication, the attacker chains this access with CVE-2024-21887. They send a subsequent request, often a POST request, to a vulnerable endpoint like `/api/v1/license/usage`. This request contains malicious commands embedded within an XML payload or other input fields that the Ivanti appliance processes. For instance, an attacker might inject commands to download and execute a webshell or establish a reverse shell. The system executes these injected commands with elevated privileges, leading to unauthenticated remote code execution. This actively exploited chain has allowed threat actors to deploy webshells, steal credentials, and establish persistence on compromised devices.

Detection

Detecting compromise requires a multi-faceted approach. Administrators should first utilize Ivanti's Integrity Checker Tool (ICT) to scan their appliances for known indicators of compromise (IOCs). This tool helps identify unexpected file modifications, new processes, or suspicious network connections. Specific IOCs include the presence of files like `/tmp/s.py`, `/data/root/tmp/tt`, or `/home/dana-user/tmp/nc`. Review system logs for unusual administrative activity, failed authentication attempts followed by successful logins from new or unknown sources, or unexpected command executions. Network monitoring is also critical; look for outbound connections from Ivanti devices to unfamiliar external IP addresses or on unusual ports. These could indicate command-and-control (C2) communication or data exfiltration. For continuous monitoring of exposed services and potential vulnerabilities, organizations can use tools like Secably. Its paid monitoring plans, starting at $19/month, offer ongoing attack surface management and vulnerability scanning. A free port scanner can help identify exposed management interfaces, which are often the initial target for such attacks. Additionally, a free website vulnerability scanner may identify exposed Ivanti instances, although deeper vulnerability detection often requires authenticated scans.

Remediation Steps

Immediate remediation is essential for this actively exploited threat. The primary step is to apply all vendor-provided patches without delay. Ivanti released out-of-band patches specifically addressing CVE-2023-46805 and CVE-2024-21887. Organizations must follow Ivanti's specific mitigation guidance, which initially included importing an XML file to restrict access to vulnerable endpoints and deploying a "mitigation patch". A critical remediation step involves performing a factory reset and a full re-imaging of any potentially compromised Ivanti Connect Secure or Policy Secure devices. This ensures the removal of any persistent backdoors or malware deployed by attackers. Simply patching a compromised device may not remove existing malicious implants. After re-imaging, all administrative credentials used on or by the Ivanti appliance must be rotated. Implementing network segmentation can further limit the blast radius if a device is compromised again. For additional insights on managing such threats, refer to our blog post, Understanding Exploits — Impact, Detection, and Remed.

Timeline of Disclosure

The timeline for the disclosure and patching of these actively exploited vulnerabilities highlights the rapid response required for critical flaws. Mandiant first identified in-the-wild exploitation of Ivanti Connect Secure appliances in December 2023. On January 10, 2024, Ivanti released its initial security advisory for CVE-2023-46805 and CVE-2024-21887, along with initial mitigation guidance. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently issued an alert on January 11, 2024, emphasizing the urgency of addressing these flaws. Ivanti then released a "mitigation patch" on January 19, 2024, followed by comprehensive security updates (patches) on January 23, 2024. Due to continued exploitation and the discovery of new attack vectors, Ivanti released further patches and strongly advised customers to perform factory resets and re-image devices throughout February 2024. This ongoing activity underscores the persistent threat posed by this actively exploited vulnerability chain.