Ivanti Zero-Days Exploited By Multiple Actors Globally
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-21887 +1 in the same advisory: …46805 | Command Injection RCE in Ivanti Connect Secure and Policy Secure Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available. Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories. | 9.1 group max | 100% | KEV ransomware PoC |
| largetens of thousands of appliances (roughly 20,000-30,000 internet-exposed ICS gateways at disclosure; total deployed base likely higher) |
Full article406 words · extracted from infosecurity-magazine.com · click to collapse
Two zero-day vulnerabilities in Ivanti products revealed last week are being exploited en masse worldwide, with over 1700 devices already compromised, Volexity has warned.
The security vendor said in a blog post yesterday that victims come from a variety of sectors including government, military, telecoms, technology, finance, consulting and aerospace.
“Victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 companies across multiple industry verticals,” it warned.
“On Sunday, January 14 2024, Volexity had identified over 1700 ICS VPN appliances that were compromised with the GiftedVisitor webshell. These appliances appear to have been indiscriminately targeted, with victims all over the world.”
Volexity believes the threat actor behind these compromises is the same Chinese group (UTA0178) first observed exploiting the zero-day vulnerabilities back in December 2023.
However, it warned that other threat actors appear to have access to the exploit and are actively targeting organizations. These include a group named “UTA0188.”
Volexity added that its scans may have uncovered only a fraction of those organizations compromised by attackers.
“This exploitation has affected thousands of machines and may have infected many more. Volexity’s scan methodology would not have worked against organizations that have already deployed the Ivanti mitigation or had otherwise been taken offline,” it concluded.
“As a result, Volexity suspects there may likely be a higher number of compromised organizations than identified through scanning (which totalled more than 1,700). There was likely a period in which UTA0178 could have actioned these compromises before the mitigation was applied.”
Ivanti first published an advisory about the two zero-days on January 10. At the time, it said that fewer than 10 customers were impacted by exploitation of CVE-2023-46805 and CVE-2024-21887: two critical bugs in its Connect Secure and Policy Secure gateways.
Read more about Ivanti zero-days: Two Ivanti Zero-Days Actively Exploited in the Wild
CVE-2023-46805 is an authentication bypass vulnerability in the web component of the two products while CVE-2024-21887 is a command injection vulnerability in the same web components. They can be chained to enable a threat actor to bypass multi-factor authentication, craft malicious requests and execute arbitrary commands for full system compromise.
Patches won’t be released until the week of January 22, and even then, on a staggered schedule according to product version. However, customers are urged to apply the vendor’s mitigation immediately and run an Integrity Checker tool provided by Ivanti.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ivanti-zerodays-exploited-multiple/