Understanding CVE-2 and How to Secure Your Systems Now
Unpacking CVE-2: Ivanti Connect Secure Authentication Bypass (CVE-2023-46805)
CVE-2023-46805 is an authentication bypass vulnerability in the web component of Ivanti Connect Secure (ICS) and Ivanti Policy Secure products. This flaw enables attackers to circumvent authentication checks, gaining unauthorized access to sensitive resources. The vulnerability carries a high CVSS score of 8.2 (High). This score reflects the significant impact on confidentiality, with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. It affects all supported versions of Ivanti Connect Secure and Ivanti Policy Secure, including versions 9.x and 22.x. This vulnerability is frequently chained with CVE-2024-21887, a command injection flaw, to achieve unauthenticated remote code execution.Technical Root Cause Analysis
The root cause of CVE-2023-46805 lies in improper validation of authentication tokens within the Ivanti Connect Secure application. This flaw permits malicious actors to gain access without valid credentials. Specifically, the vulnerability is a path traversal issue within the appliance's web interface. Attackers manipulate certain URI paths to access restricted endpoints, bypassing the authentication checks performed by the native C++ web server component. The native web server handles incoming HTTPS requests, including those for a Python-based REST API. Authentication enforcement occurs in the native web server, not in the Flask application implementing the REST API. The bypass occurs due to a `strncmp` function checking only the first N characters of a path, allowing specially crafted requests to bypass authentication.Exploitation Mechanics
Exploiting CVE-2023-46805 begins with an attacker scanning the internet for vulnerable Ivanti gateways. Once a target is identified, the attacker sends a specially crafted HTTP request to the device. This request manipulates URI paths to access restricted administrative endpoints, effectively bypassing the login screen. For instance, an attacker might craft a GET request to `/api/v1/totp/user-backup-code/../../system/system-information` or `/api/v1/cav/client/status/../../admin/options` to access system information or administrative options without authentication. This initial bypass does not grant code execution on its own. It provides an unauthenticated attacker access to the internal workings of the VPN gateway, setting the stage for subsequent, more damaging attacks. Attackers commonly chain this vulnerability with CVE-2024-21887, a command injection flaw, to achieve unauthenticated remote code execution. This combination allows for arbitrary command execution, deployment of webshells for persistence, credential theft, and deeper network compromise.Detection: How to Check If You're Affected
Organizations must check for indicators of compromise to determine if they are affected by Unpacking CVE-2. Monitor network traffic for unusual patterns or spikes in unauthorized access attempts. Look for requests with suspiciously malformed tokens or access to normally restricted endpoints from unauthenticated IP addresses in web logs. Secably offers a free website vulnerability scanner that can help identify exposed Ivanti instances. You can also use a free port scanner to identify open ports that might expose the Ivanti Connect Secure web interface. Ivanti provides an external Integrity Checker Tool (ICT) to scan for signs of compromise, such as modified files or unauthorized processes. However, CISA and other partners have noted that Ivanti's internal and previous external ICTs failed to detect compromise in some instances. Forensic imaging of the device is recommended for definitive compromise assessment. Security Information and Event Management (SIEM) solutions can monitor for outbound connections from the VPN appliance to suspicious domains or for webshell creation in device directories. Tools like Splunk can detect POST requests to specific URIs that leverage command injection, especially when chained with CVE-2024-21887. Additionally, Zondex can assist with internet-wide scanning to identify exposed Ivanti Connect Secure instances.Remediation Steps
Immediate patching is the top priority for mitigating CVE-2023-46805. Ivanti has released security patches addressing this issue for all affected versions (9.x and 22.x). Administrators should apply these updates without delay. Specific patched versions for Ivanti Connect Secure include 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, and later. For Ivanti Policy Secure, upgrade to versions 9.1R17.2, 9.1R18.3, 22.5R1.1, or later. Before applying patches, run the Ivanti Integrity Checker Tool to check for signs of prior compromise. If the tool finds any compromise, initiate incident response procedures. As a temporary workaround before patches were widely available, Ivanti provided an XML file import. This mitigation helps block exploitation but does not replace a full patch. Disable external access to affected components until patches are applied. Consider enforcing strict firewall rules to restrict access to Ivanti products to essential personnel only. Implement additional access controls, such as multi-factor authentication. Regularly review authentication logs for anomalies. After patching, conduct a thorough security assessment to confirm no compromise occurred.Timeline of Disclosure
Ivanti disclosed CVE-2023-46805 on January 10, 2024. This disclosure followed observations by security researchers of active exploitation in the wild. The vulnerability was exploited as a zero-day before public disclosure. Initial exploitation of the chained vulnerabilities (CVE-2023-46805 and CVE-2024-21887) was observed as early as December 2023. The CVE-2023-46805 record was published to NVD on January 12, 2024. Ivanti released security patches in a staggered schedule, with initial patches becoming available from January 10, 2024, and subsequent updates throughout February and April 2024. CISA issued an emergency directive on January 19, 2024, due to the unacceptable risks posed by these vulnerabilities to federal agencies. Intense scanning for the vulnerability increased significantly after exploit details became public on January 16, 2024.Check your site for vulnerabilities
Run a free security scan — no signup, results in seconds.
