How Deep Dive into BlueMoon Works and What You Should Patch

Deep Dive into BlueMoon

The "BlueMoon" analysis focuses on critical vulnerabilities in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) gateways. Specifically, this deep dive examines CVE-2023-46805, an authentication bypass, and CVE-2024-21887, a command injection flaw. Chained together, these vulnerabilities enable unauthenticated remote code execution (RCE) on affected appliances.

What the Vulnerability Is and Its Impact

CVE-2023-46805 allows an unauthenticated attacker to bypass authentication checks. This vulnerability affects the web component of Ivanti Connect Secure (versions 9.x, 22.x prior to 9.1R14.4, 22.4R2.2, 22.5R1.1) and Ivanti Policy Secure (versions 9.x, 22.x prior to 22.5R1.1). The CVSS v3.1 score for CVE-2023-46805 is 8.2 (High) for Authentication Bypass. CVE-2024-21887 is a command injection vulnerability. This flaw impacts the same Ivanti products and versions. It allows an authenticated administrator to execute arbitrary commands on the appliance. When combined with CVE-2023-46805, an unauthenticated attacker gains remote code execution. The CVSS v3.1 score for CVE-2024-21887 is 9.1 (Critical) for Command Injection. These vulnerabilities severely impact the confidentiality, integrity, and availability of affected systems. Organizations widely deploy Ivanti gateways as crucial network access points. Successful exploitation grants attackers persistent access, data exfiltration capabilities, and potential lateral movement into internal networks.

Technical Root Cause Analysis

The root cause of CVE-2023-46805 lies within how the Ivanti Connect Secure web server handles specific URI paths. The `web.info.handler` CGI script is responsible for processing requests to certain administrative functions. This script contains a logic flaw. It fails to adequately enforce authentication for specific URL endpoints. The `web.info.handler` script, written in Perl, uses a series of regular expressions and conditional statements to determine if a request requires authentication. Attackers discovered a specific URI pattern that bypasses these checks. By appending a specially crafted path segment, such as `/api/v1/license/usage` or `/api/v1/configuration/users/user-roles`, to the base URL, the system incorrectly processes the request as unauthenticated. For example, a request to `/dana-na/nc/nc_gina_reg.cgi` typically requires authentication. However, appending `/dana-na/nc/nc_gina_reg.cgi/api/v1/license/usage` causes the `web.info.handler` to misinterpret the authentication requirement. The script proceeds to execute parts of the handler logic without verifying user credentials. This provides unauthorized access to system information or, more critically, sets the stage for further exploitation. The command injection vulnerability, CVE-2024-21887, exists within the `set_param_value` function. This function is present in multiple CGI scripts, including `compcheckresult.cgi`. The `set_param_value` function processes various parameters, many of which originate from user input. It constructs system commands using these parameters without sufficient sanitization. Specifically, the vulnerability allows an attacker to inject arbitrary commands into arguments passed to `system()` or `qx()` calls within the Perl scripts. An authenticated administrative user can manipulate parameters like `name` or `value` within specific POST requests. These parameters are then directly concatenated into shell commands. This execution happens with elevated privileges. The combination of these flaws creates a critical attack chain. The authentication bypass (CVE-2023-46805) grants an unauthenticated attacker access to endpoints that would normally require administrative credentials. Once this bypass is active, the attacker can then leverage the command injection (CVE-2024-21887) by sending crafted requests to the vulnerable `set_param_value` function. This results in arbitrary command execution on the underlying Linux operating system of the Ivanti appliance.

Exploitation Mechanics

Exploitation of the "BlueMoon" vulnerabilities begins with the authentication bypass. An attacker sends a GET request to a specially crafted URL. This URL targets an administrative endpoint but includes the bypass pattern.

GET /dana-na/nc/nc_gina_reg.cgi/api/v1/license/usage HTTP/1.1
Host: [IVANTI_HOST]
User-Agent: Mozilla/5.0

This request bypasses the authentication mechanism. The server responds with legitimate (though potentially unprivileged) information. This confirms the bypass is successful. The attacker now has access to certain internal functions that should be restricted. After authentication bypass, the attacker exploits CVE-2024-21887. They send a POST request to a CGI script containing the vulnerable `set_param_value` function, such as `compcheckresult.cgi`. The request includes a malicious command injected into a parameter.

POST /dana-na/compcheck/compcheckresult.cgi HTTP/1.1
Host: [IVANTI_HOST]
Content-Type: application/x-www-form-urlencoded
Content-Length: [LENGTH]

name=config_id&value=;id&_dc=1704987654321

In this example, the `value` parameter contains `id`. This command executes on the Ivanti appliance. The server's response may include the output of the `id` command, confirming successful command injection. Attackers typically use more sophisticated commands to establish persistence, download additional payloads, or exfiltrate data. They might use commands like `curl` to fetch a reverse shell script or `echo` to write files. The command injection often occurs within a context that executes with root privileges. This grants the attacker full control over the compromised gateway. Attackers can then modify system configurations, inject malicious code into legitimate processes, or pivot to other systems within the network. The ability to execute arbitrary commands makes these vulnerabilities extremely dangerous.

Detection

Detecting "BlueMoon" exploitation requires thorough log analysis and network traffic monitoring. Look for unusual access patterns to administrative endpoints. Specifically, search for requests to `web.info.handler` or `compcheckresult.cgi` that do not originate from authenticated sessions. Review web server access logs for requests containing the authentication bypass pattern, such as `/dana-na/nc/nc_gina_reg.cgi/api/v1/`. Also, look for POST requests to CGI scripts like `compcheckresult.cgi` with suspicious parameters containing shell metacharacters (e.g., `;`, `|`, `&`, `$()`, `` ` ``). Organizations should deploy a Secably vulnerability scanner to regularly check for known Ivanti vulnerabilities. Our free website vulnerability scanner can help identify exposed Ivanti instances and detect certain configurations indicative of compromise. Regularly scanning your external attack surface with tools like Secably's free port scanner helps identify unexpected open ports or services that could indicate post-exploitation activity or misconfigurations. Monitor outbound network connections from Ivanti appliances for unusual destinations or protocols. Attackers often establish reverse shells or exfiltrate data to external command and control (C2) servers. Network intrusion detection systems (NIDS) and endpoint detection and response (EDR) solutions are crucial for flagging such anomalies. Zondex, an internet-wide scanning service, can help identify if your Ivanti devices are exposed to the public internet and potentially vulnerable. Check for unexpected files or modified system binaries on the Ivanti appliance. Attackers often drop webshells or replace legitimate binaries to maintain persistence. Review system processes for any unfamiliar or suspicious entries. A deep dive into unpacking CVEs, such as those covered in our blog, provides further insights into post-exploitation artifacts.

Remediation Steps

Immediate remediation involves applying the vendor-supplied patches. Ivanti released out-of-band updates to address CVE-2023-46805 and CVE-2024-21887. Organizations must prioritize applying these patches. The specific patched versions are:

• Ivanti Connect Secure (ICS) versions 9.1R14.4, 22.4R2.2, 22.5R1.1, 22.6R1.3, 22.7R1.1
• Ivanti Policy Secure (IPS) version 22.5R1.1

Ensure all affected appliances are updated to these or later versions. After patching, conduct a thorough compromise assessment. Check for indicators of compromise (IoCs) as detailed in Ivanti's advisories and third-party security reports. This includes scanning for webshells, suspicious user accounts, and unexpected network connections. Reset all administrative credentials on the Ivanti appliances. Assume that attacker exposure compromised existing credentials. Implement multi-factor authentication (MFA) for all administrative interfaces. Review and restrict network access to the Ivanti management interfaces. Limit access to trusted IP ranges. Consider deploying an external Web Application Firewall (WAF) in front of Ivanti gateways. Configure the WAF to detect and block requests containing known exploitation patterns for "BlueMoon" vulnerabilities. This adds an additional layer of defense. Regular security audits and penetration testing of your Ivanti infrastructure are also recommended. Secably offers various monitoring plans, including options starting at $19/month, to help maintain continuous oversight of your security posture.

Timeline of Disclosure

Mandiant first reported the "BlueMoon" vulnerabilities (CVE-2023-46805 and CVE-2024-21887) to Ivanti in December 2023. This initiated a coordinated disclosure process. On January 10, 2024, Ivanti publicly disclosed the vulnerabilities. They released an initial security advisory detailing the authentication bypass and command injection flaws. This advisory included initial mitigation steps. Throughout January 2024, Ivanti provided further updates and released the first set of patches. These patches aimed to address the identified vulnerabilities. On January 31, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive (ED) 24-01. This directive ordered federal agencies to disconnect Ivanti Connect Secure and Policy Secure products from their networks due to active exploitation. Ivanti continued to release additional patches and mitigations into February 2024. These updates addressed further bypasses and new vulnerabilities discovered during ongoing analysis and active exploitation. The rapid pace of updates highlighted the severity and widespread impact of the "BlueMoon" vulnerabilities.