Ivanti Discloses Five Vulnerabilities, Including Flaws Reported Exploited in the Wild
Summary
Ivanti vulnerabilities affecting Connect Secure, Policy Secure and ZTA gateways include flaws reported exploited in the wild. The article describes affected products, patch versions, mitigations and federal response requirements.
Key points
- The article covers CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, CVE-2024-21893 and the later-disclosed CVE-2024-22024.
- The flaws include authentication bypass, command injection, privilege escalation and SSRF; some can expose restricted resources or enable remote code execution.
- CVE-2023-46805 and CVE-2024-21887 were reportedly exploited as zero-days from December 2023; CVE-2024-21893 was also confirmed exploited in the wild by Ivanti.
- CVE-2024-22024, an authentication bypass in the SAML component, was reported exploited in the wild on February 9, 2024.
- Affected products include Ivanti Connect Secure and Policy Secure versions 9.x and 22.x, as well as ZTA gateways for CVE-2024-22024.
- Ivanti released patches for the vulnerabilities; the article advises urgent patching and provides fixed versions for CVE-2024-22024. It also recommends a workaround or avoiding public exposure if earlier patches cannot be applied.
- CISA directed US federal agencies to disconnect affected products and conduct threat hunting, monitoring and credential-reset measures.
Article Details
- Vulnerability Types
- Authentication bypass
- Command injection
- Privilege escalation
- Server-side request forgery (SSRF)
- Severity
- High; the article describes the vulnerabilities as high severity.
- Affected Versions
- Ivanti Connect Secure 9.x
- Ivanti Connect Secure 22.x
- Ivanti Policy Secure 9.x
- Ivanti Policy Secure 22.x
- Ivanti Neurons for ZTA
- ZTA gateways
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Before patches were available, Ivanti advised importing an XML file from its download portal.
- If unable to patch, avoid publicly exposing the affected products to the Internet.
- CISA mandated that affected federal agencies disconnect the products from their networks.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationCVE-2024-21888 is described as a privilege-escalation flaw that can grant a user administrator-level privileges.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of vulnerabilities in internet-reachable Ivanti appliances, including authentication bypass and command injection.
CVE
CVE-2023-46805mitigation strategies (but no patches) for two vulnerabilities affecting Connect Secure VPN devices: CVE-2023-46805 and CVE-2024-21887. When exploited in tandem, they enable unauthenticated remote code execution, andCVE-2024-21887(but no patches) for two vulnerabilities affecting Connect Secure VPN devices: CVE-2023-46805 and CVE-2024-21887. When exploited in tandem, they enable unauthenticated remote code execution, and Ivanti urgedCVE-2024-21888A few weeks later, on January 31, 2024, Ivanti disclosed two more high-severity vulnerabilities: CVE-2024-21888, a privilege escalation flaw, and CVE-2024-21893, a server-side request forgery (SSRF), affecting bothCVE-2024-21893disclosed two more high-severity vulnerabilities: CVE-2024-21888, a privilege escalation flaw, and CVE-2024-21893, a server-side request forgery (SSRF), affecting both Ivanti Connect Secure and Ivanti Policy Secure.CVE-2024-220248, 2024, Ivanti released an advisory for a new authentication bypass high severity vulnerability, CVE-2024-22024 impacting Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways. The
Threat Actors
ARMORY CASTLETracked group reported exploiting CVE-2023-46805 and CVE-2024-21887 as zero-days as early as December 3, 2023; described as China-nexus.UTA0178The article identifies UTA0178 as an alternate tracking name for UNC5221, a group reported exploiting CVE-2023-46805 and CVE-2024-21887 as zero-days.
Vendors
IvantiOn February 8, 2024, Ivanti released an advisory for a new authentication bypass high severity vulnerability, CVE-2024-22024 impacting Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTAWizWiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment.
Products
Ivanti Connect Securean advisory for a new authentication bypass high severity vulnerability, CVE-2024-22024 impacting Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways. The flaw in the SAML component ofIvanti Neurons for ZTASAML component of Ivanti Connect Secure, Ivanti Policy Secure (both versions 9.x and 22.x), and Ivanti Neurons for ZTA. This vulnerability enables an attacker to access certain restricted resources without needing toIvanti Policy Securebypass high severity vulnerability, CVE-2024-22024 impacting Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways. The flaw in the SAML component of the mentioned products allows anWiz InventoryWiz customers can check the Wiz Inventory to pinpoint all resources running Ivanti Connect Secure or Policy Secure in their cloud environment, as identified by either agentless or unauthenticated scanning. Additionally,Wiz Threat CenterWiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment.