CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available

Background

On August 13, Ivanti released a security advisory to address a critical severity authentication bypass vulnerability in its Virtual Traffic Manager (vTM) product, a software-based application delivery controller (ADC).

Analysis

CVE-2024-7593 is a critical severity authentication bypass vulnerability. Exploitation of this flaw could allow an unauthenticated, remote attacker to create an administrator user. According to the advisory, access to the management interface of vTM is required in order to exploit this vulnerability.

While Ivanti notes that no known exploitation has been observed for CVE-2024-7593, their advisory makes special note of publicly available exploit code.

Historical exploitation of Ivanti vulnerabilities

Ivanti has had a history of threat actors targeting their products, with one of the most prolific being attacks against their Ivanti Connect Secure (ICS) product, previously known as Pulse Connect Secure and Ivanti Policy Secure. In January, two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) were exploited against ICS in a chained attack. Coincidentally enough, one of these vulnerabilities (CVE-2023-46805) was an authentication bypass flaw. Within a few weeks of this release, Ivanti found several additional vulnerabilities impacting ICS, including another zero-day vulnerability (CVE-2024-21893) that had also been exploited in the wild. CVE-2023-46805 and CVE-2024-21887 were reportedly exploited by a threat actor tracked as UTA0178 and is believed to be a “Chinese nation-state level threat actor.” With threat actors, including nation-state aligned actors actively targeting Ivanti devices, it’s imperative that patching is prioritized.

Hundreds of Internet Facing Instances May Be Affected

Adding to the concern over the potential to exploit this vulnerability, a FOFA search lists more than 400 results tied to over 200 unique IPs that might be affected if patches or mitigations are not applied.

Image source: https://en.fofa.info/

Proof of concept

According to Ivanti’s security advisory, a public proof-of-concept (PoC) is available for this vulnerability. While Tenable Research has not tested and confirmed a working exploit, we are aware of exploit code found on a popular site for public exploit scripts. As attackers are keen to abuse targets with readily available exploit code, immediate patching or application of mitigation steps is recommended.

Solution

Ivanti has released some patches to address this vulnerability, with additional patch versions expected to be released the week of August 19. A summary of the patched versions can be found in the table below:

For organizations that are not able to immediately patch this vulnerability, Ivanti does offer mitigation guidance. As access to the management interface is a requirement for exploitation, limiting access to this interface is recommended. Ivanti recommends to ensure that the management interface is bound to an internal network or private IP address. We recommend referring to Ivanti’s security advisory for the most up to date information on patch availability and mitigation guidance.

Identifying affected systems

A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-7593 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Get more information

• Ivanti Security Advisory: Ivanti Virtual Traffic Manager (vTM ) (CVE-2024-7593)

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.