Unpacking Critical RCE Vulnerabilities (CVEs)

Critical RCE Vulnerabilities (CVE-2024-21887) in Ivanti Connect Secure and Policy Secure gateways pose a severe threat to organizations globally. This command injection vulnerability, with a CVSS score of 9.1, allows authenticated administrators to execute arbitrary commands on the appliance. When chained with CVE-2023-46805, an authentication bypass vulnerability with a CVSS score of 8.2, attackers achieve unauthenticated remote code execution. This combination grants full control over affected systems, leading to potential data breaches and system disruption.

What the Vulnerability Is and Its Impact

CVE-2024-21887 is a command injection vulnerability present in the web components of Ivanti Connect Secure (versions 9.x, 22.x) and Ivanti Policy Secure (versions 9.x, 22.x). An attacker can send specially crafted requests, enabling arbitrary command execution on the appliance. This vulnerability has a critical CVSS v3.1 base score of 9.1. It allows for remote code execution, granting an attacker full control over the compromised system.

CVE-2023-46805, an authentication bypass vulnerability, affects the same Ivanti products and versions. This flaw allows a remote attacker to access restricted resources by bypassing control checks. It carries a high CVSS v3.1 base score of 8.2. When attackers chain CVE-2023-46805 with CVE-2024-21887, they achieve unauthenticated remote code execution, making the impact even more severe.

Technical Root Cause Analysis

The root cause of CVE-2024-21887 lies in improper validation of user-supplied input within the web interface's command execution flow. Specifically, the vulnerability resides in how Ivanti Connect Secure processes requests to certain web components, such as the setconfig endpoint. The system executes commands without proper sanitization of input, allowing an authenticated administrator to inject malicious commands.

The authentication bypass (CVE-2023-46805) stems from a flaw in the web component that allows circumvention of authentication checks. This enables an unauthenticated attacker to reach endpoints that should only be accessible to authenticated users. By bypassing authentication, an attacker gains the necessary access to then exploit the command injection vulnerability.

Exploitation Mechanics

Exploitation of Critical RCE Vulnerabilities (CVE-2024-21887) typically involves a two-step process when targeting an unauthenticated appliance. First, an attacker exploits CVE-2023-46805 to bypass authentication. This involves sending a specially crafted HTTP request to an Ivanti Connect Secure gateway. The request manipulates the URL path to access restricted resources without valid credentials.

After bypassing authentication, the attacker then exploits CVE-2024-21887. This involves sending another specially crafted HTTP POST request to a vulnerable endpoint. The request includes injected commands within a parameter that the system processes without proper sanitization. These commands then execute on the underlying operating system with elevated privileges.

A conceptual payload for command injection might look like this, targeting an endpoint that processes configuration commands:

POST /api/v1/configuration/setconfig HTTP/1.1
Host: vulnerable.ivanti.com
Content-Type: application/x-www-form-urlencoded

config_param=value%3Bcat%20/etc/passwd%3B

The %3B represents a semicolon, acting as a command separator. This allows the injected command (cat /etc/passwd) to execute after the legitimate config_param is processed. Threat actors have been observed using this chain to deploy web shells, exfiltrate data, and establish persistence.

Detection

Detecting compromise from these Critical RCE Vulnerabilities (CVE-2024-21887) requires diligent monitoring. Look for unusual HTTP POST requests to administrative interfaces containing unexpected shell metacharacters or patterns indicative of command injection. Specifically, monitor for requests to URIs associated with configuration or command execution that contain characters like semicolons (;), backticks (`), or pipe symbols (|).

Examine system logs, particularly /data/log/system.log, for signs of unauthorized command execution. Look for new or modified files in unusual directories, especially /tmp/, or suspicious entries in crontab. Unexpected outbound network connections from the Ivanti appliance, which could indicate command-and-control (C2) communication or data exfiltration, are also critical indicators.

Ivanti provides an Integrity Checker Tool (ICT) designed to spot file modifications and other signs of compromise. However, attackers have been observed modifying the ICT to report no new or mismatched files, even if compromise occurred. Organizations should run the external ICT in conjunction with continuous monitoring and thorough forensic analysis.

Regularly scan your external attack surface for exposed Ivanti devices. Our free website vulnerability scanner can help identify publicly accessible instances, while a free port scanner can reveal open ports that might expose management interfaces. For continuous attack surface management and vulnerability scanning, consider Secably. Paid plans start at $19/month and include ongoing monitoring capabilities.

Remediation Steps

Immediate remediation involves applying Ivanti's official patches for all affected versions of Connect Secure and Policy Secure gateways. Ivanti released initial patches on January 31, 2024, with subsequent updates. Prioritize patching systems exposed to the internet.

If compromise is suspected or detected, perform a factory reset of the appliance before applying patches. This ensures the removal of any persistent backdoors or malicious modifications made by attackers. Simply patching a compromised system without a factory reset may leave attacker access intact.

Implement network segmentation to isolate Ivanti Connect Secure appliances from critical internal networks. Limit network access to management interfaces to trusted IP addresses only. Monitor for post-exploitation artifacts, including web shells, modified scripts, and unusual processes. Consider deploying a web application firewall (WAF) to filter malicious requests targeting these endpoints.

Timeline of Disclosure

Volexity first observed exploitation of these zero-day vulnerabilities in Ivanti Connect Secure VPN appliances as early as December 3, 2023. This initial exploitation was targeted.

On January 10, 2024, Volexity publicly disclosed details of the active exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection). Ivanti simultaneously released an advisory and initial mitigations.

Mandiant also reported their observations of exploitation around January 11, 2024. By January 15, 2024, Volexity reported widespread exploitation, affecting thousands of machines.

Ivanti released out-of-band patches to address these vulnerabilities on January 31, 2024. Further patches and an updated Integrity Checker Tool followed in February and April 2024.