Stop Zero-Day Exploits — Understand How They

Actively Exploited Zero-

Ivanti Connect Secure and Policy Secure gateways faced an Actively Exploited Zero- vulnerability chain. This critical issue, comprising CVE-2023-46805 and CVE-2024-21887, allowed unauthenticated attackers to bypass security controls and execute arbitrary commands. Threat actors exploited these flaws in the wild before vendor patches were available, leading to widespread compromise of vulnerable appliances. Organizations using these products faced immediate threats to network integrity and data confidentiality.

What the vulnerability is and its impact

CVE-2023-46805 is an authentication bypass vulnerability. It impacts Ivanti Connect Secure (versions 9.x, 22.x) and Ivanti Policy Secure (versions 9.x, 22.x) gateways. This flaw allows an unauthenticated attacker to access restricted resources on the appliance. The CVSSv3.1 score for CVE-2023-46805 is 8.2 (High).

CVE-2024-21887 is a command injection vulnerability. It affects the same Ivanti products and versions. An authenticated administrator can inject arbitrary commands on the appliance. When chained with CVE-2023-46805, unauthenticated attackers can achieve remote code execution. The CVSSv3.1 score for CVE-2024-21887 is 9.1 (Critical).

The combined impact of these two vulnerabilities is severe. Attackers gain full control over the vulnerable Ivanti gateway. This includes access to internal networks, data exfiltration, and the ability to establish persistent backdoors. Compromised devices can serve as launchpads for further attacks within an organization's infrastructure.

Technical root cause analysis

CVE-2023-46805 stems from an improper authorization vulnerability within the web component of Ivanti Connect Secure and Policy Secure. Specifically, the vulnerability resides in the web.framework module's handling of specific URI patterns. Attackers can leverage path traversal techniques to bypass authentication checks. This allows access to internal API endpoints that should only be accessible to authenticated users.

The root cause involves the appliance's inability to correctly validate requests targeting certain internal resources. By manipulating the URL path, an attacker can trick the system into processing requests as if they originated from an authenticated session. This bypasses the typical authentication flow, granting unauthorized access to sensitive functionalities. For example, requests to /api/v1/license/keys-status/ or /api/v1/system/configuration/ could be accessed without credentials.

CVE-2024-21887 is a server-side command injection vulnerability. It is present in multiple web components, including the magma and SAML service. The core issue lies in the inadequate sanitization of user-supplied input before it is passed to system commands. The appliance executes these commands with elevated privileges.

An attacker who bypasses authentication via CVE-2023-46805 can then send specially crafted requests containing malicious commands. The vulnerable components fail to properly escape or validate these inputs. This directly leads to the execution of arbitrary commands on the underlying operating system. The commands run within the context of the Ivanti appliance, often with root privileges.

Exploitation mechanics

The exploitation of the Ivanti Connect Secure vulnerabilities typically involves a two-stage attack. First, an attacker utilizes CVE-2023-46805 to bypass authentication. This initial step provides unauthenticated access to specific internal endpoints. These endpoints are usually protected by authentication mechanisms.

After achieving authentication bypass, the attacker proceeds to exploit CVE-2024-21887. They send a subsequent request to a vulnerable endpoint, such as one associated with the SAML component. This request contains a malicious payload designed for command injection. The appliance processes this unsanitized input, executing the attacker's commands. This grants the attacker remote code execution capabilities on the Ivanti gateway.

An example of a conceptual exploitation flow might involve an attacker sending a GET request with a specially crafted URI to bypass authentication. This could target an internal API endpoint. Subsequently, they would send a POST request to another vulnerable endpoint, embedding shell commands within a parameter. The system executes these commands, allowing actions like creating new user accounts, deploying web shells, or establishing reverse shells to external command-and-control servers. This complete chain represents a severe Actively Exploited Zero- threat.

Detection: how to check if you're affected

Organizations must proactively check for signs of compromise. Examine Ivanti Connect Secure and Policy Secure appliance logs. Look for unusual requests to sensitive API endpoints. Specifically, monitor for unauthenticated access attempts to /api/v1/license/keys-status/, /api/v1/system/configuration/, or any requests containing /_if_.

Review system processes and file integrity on the appliance. Malicious activity might include new, unexpected processes running or unauthorized file modifications. Check for newly created user accounts or suspicious outbound network connections originating from the Ivanti device. Indicators of Compromise (IOCs) published by Ivanti and CISA provide specific filenames, hashes, and network patterns to search for.

Ivanti released an external Integrity Checker Tool (ICT) and an internal ICT. Running these tools helps identify modifications to the filesystem that may indicate compromise. These tools are crucial for detecting persistence mechanisms left by attackers. However, they are not foolproof against sophisticated adversaries who might evade detection.

Network monitoring is essential. Look for unusual traffic patterns or connections from your Ivanti appliances to unknown external IP addresses. This could indicate data exfiltration or command-and-control communication. Organizations can also use tools like Zondex for external reconnaissance to identify exposed Ivanti instances. This helps in understanding the external attack surface. Stopping Active Exploits Impact, Detection, requires continuous vigilance.

Secably offers various tools to help identify potential exposure. Use the free port scanner to identify if your Ivanti Connect Secure gateway is exposed to the internet on standard ports (e.g., 443). The technology stack detector can help confirm if Ivanti products are running on your public-facing infrastructure. While not directly detecting these specific CVEs, these tools aid in initial attack surface assessment. Secably's paid monitoring plans, starting at $19/month, provide continuous scanning capabilities for broader vulnerability management.

Remediation steps

Immediate patching is the primary remediation step. Ivanti released out-of-band patches to address these vulnerabilities. Apply these updates without delay. Specific patched versions include Ivanti Connect Secure 9.1R14.4, 9.1R17.3, 9.1R18.5, 22.4R2.2, 22.5R1.1, and 22.6R1.1, among others. Also, Ivanti Policy Secure 9.1R17.3 and 22.5R1.1 received patches.

If direct patching is not immediately feasible, Ivanti provided temporary mitigation strategies. For CVE-2023-46805, an XML file import workaround was released. This workaround restricts access to the vulnerable endpoints. However, these mitigations are temporary and do not replace applying the official security updates.

Assume compromise if you were running vulnerable versions. Perform a factory reset of the appliance. Then, re-image it to a clean, supported version before applying patches. Simply applying patches to an already compromised system may not remove persistent attacker access. Attackers often leave backdoors or modify system configurations.

Rotate all credentials associated with the Ivanti appliance. This includes administrator accounts, service accounts, and any credentials stored on the device. Review all logs for any signs of post-exploitation activity, even after re-imaging. This ensures no lingering access or data exfiltration occurred. Isolate affected systems from the network during the remediation process to prevent further spread of compromise.

Timeline of disclosure

Mandiant first identified active exploitation of these vulnerabilities in December 2023. They observed sophisticated threat actors leveraging the chain to compromise Ivanti Connect Secure appliances. This indicated an Actively Exploited Zero- situation.

On January 10, 2024, Ivanti publicly disclosed CVE-2023-46805 and CVE-2024-21887. The vendor confirmed active exploitation and released initial mitigation guidance. This disclosure alerted the security community to the critical threat.

Following Ivanti's disclosure, CISA issued an emergency directive on January 11, 2024. This directive urged federal agencies to disconnect or patch vulnerable Ivanti products immediately. This highlighted the severe risk posed by the zero-day exploits.

Throughout January and February 2024, Ivanti released several rounds of patches. These addressed the initial vulnerabilities and subsequent findings of additional chained vulnerabilities and new zero-days. The vendor also provided updated integrity checker tools and more comprehensive remediation advice as the situation evolved. This ongoing response underscored the complexity of dealing with an active zero-day campaign.