Frequently asked questions for five CVEs affecting Ivanti Connect Secure and Policy Secure Gateways, with three of the vulnerabilities having been exploited in the wild as zero-days.

CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893: Frequently Asked Questions for Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

Two zero-day vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure have been exploited in the wild, with at least one attack attributed to nation-state actors.

CVE-2023-46805, CVE-2024-21887: Zero-Day Vulnerabilities Exploited in Ivanti Connect Secure and Policy Secure Gateways

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by a command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) which allows an unauthenticated attacker to send specially crafted requests and execute arbitrary commands on the appliance. This vulnerability can be exploited over the internet.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by a command injection vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) which allows an unauthenticated attacker to send specially crafted requests and execute arbitrary commands on the appliance. This vulnerability can be exploited over the internet.

Ivanti Connect Secure 9.x, 22.x suffers from an authentication bypass vulnerability.

By crafting a specific HTTP request, a remote and unauthenticated attacker could exploit this vulnerability to bypass authentication and authorization requirements.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
190367	Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	critical
189951	Ivanti Connect Secure 9.x / 22.x Command Injection Vulnerability (CVE-2024-21887)	Nessus	CGI abuses	critical
189950	Ivanti Policy Secure 9.x / 22.x Command Injection Vulnerability (CVE-2024-21887)	Nessus	CGI abuses	critical
114165	Ivanti Connect Secure 9.x / 22.x Authentication Bypass	Web App Scanning	Component Vulnerability	critical
187908	Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2024-21887

critical

Tenable Plugins

critical

critical

critical

critical

critical