Immediate Actions to Protect Against Multiple Zero-day Vulnerabilities in Ivanti Products

Ivanti has flagged multiple vulnerabilities affecting Ivanti Connect Secure (ICS) and Ivanti Policy Secure and Ivanti Neurons for Zero Trust Access (ZTA) gateways. These include three zero-day vulnerabilities, authentication bypass (CVE-2023-46805), command injection (CVE-2024-21887) and server-side request forgery (CVE-2024-21893) vulnerabilities. There are reports that the vulnerabilities are actively exploited by threat actors.

The vulnerabilities are as follows:

• CVE-2023-46805: An authentication bypass vulnerability in the web component of vulnerable versions of Ivanti Connect Secure and Ivanti Policy Secure may allow a remote attacker to access restricted resources by bypassing control checks.

• CVE-2024-21887: A command injection vulnerability in web components of vulnerable versions of Ivanti Connect Secure and Ivanti Policy Secure may allow an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

• CVE-2024-21888: A privilege escalation vulnerability in the web component of Ivanti Connect Secure and Ivanti Policy may allow an attacker to elevate privileges to that of an administrator.

• CVE-2024-21893: A server-side request forgery vulnerability in the Security Assertion Markup Language (SAML) component of Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA may allow an unauthenticated attacker to access certain restricted resources.

When chained, the zero-day vulnerabilities allow attackers to move laterally within a target's network, exfiltrate data, and establish persistent system access by deploying backdoors.

The following products are affected by the vulnerabilities:

• Ivanti Connect Secure versions 9.x and 22.x

• Ivanti Policy Secure versions 9.x and 22.x

• Ivanti Neurons for ZTA

Containment Actions

Organisations running impacted systems are advised to perform the following immediate containment and investigative actions:

• Disconnect and isolate the impacted appliance(s) from the networks and any enterprise resources to the greatest degree possible.

• Run the external Integrity Checker Tool (ICT) to identify potential signs of compromise. Ivanti recommends running the external ICT as there have been observed attempts by threat actors to evade detection by manipulating Ivanti's internal (built-in) ICT.

• Provide the results to Ivanti support for further review. Ivanti will decide if the appliance is compromised and recommend next steps. Ivanti can also provide assistance with decryption and capturing a forensic / memory image from the impacted appliance(s). 

• Perform a forensic review of the captured image(s) to identify additional signs of compromise or malicious activities.

• Review available logs from the appliance(s), including:

• VPN device logs - ensures the VPN logs can be viewed on the web or exported for offline analysis. This can be accessed via System > Log/Monitoring from the administrative interface.  

• Unauthenticated Request logging - ensures unauthenticated web requests made to the Connect Secure VPN appliance(s) are recorded in the user logs. This can be configured via System > Log/Monitoring > User Access > Select Events to Log. 

• Syslog forwarding - ensures appliance logs are available offline from the appliance(s) and cannot be modified. It is recommended that the following log types be configured for SYSLOG forwarding:

• Events

• User Access 

• Admin Access

Remediation Measures

Organisations running impacted systems are advised to perform the following remediation measures before bringing them into production:

• Preserve a forensic image from the impacted appliance(s) for forensic analysis and investigative purposes.

• Backup and export the configuration settings of the impacted appliance(s).

• Conduct a factory reset or rebuild the appliance(s) by upgrading TWICE to one of the following supported software versions through Ivanti’s download portal at  https://www.ivanti.com/resources/downloads. 

• When upgrading, any exploited or added files on the device will not persist through the upgrade. 

• Future rollbacks would make an organisation vulnerable if restoring to the compromised version. Two upgrades remove the compromised version - as only one rollback version is stored on the appliance.

• Download and apply the official patch immediately. 

• If a previous mitigation (XML file) was applied before the patch, it can be removed once the patch has been applied. The mitigation removal XML process can be found in the download portal.

• If a patch is not yet available for a vulnerable appliance,

• Apply the mitigation patch (via importing the mitigation.release.20240126.5.xml file) after the upgrade has been completed. Do note that applying the XML file may impact functionality and features of an appliance, including SAML authentication. 

• Stop the push of configurations to appliances once the XML file is in place, and do not resume pushing configurations until formal patches have been issued by Ivanti. This includes any configurations that are pushed using Pulse One and/or nSA. Pushing configurations to an appliance will stop the short-term mitigation from functioning.

• Restore the device configuration.

• Revoke or rotate any device-specific secrets stored on the appliance(s) prior to compromise. 

• Revoke and reissue any connected or exposed certificates, keys, and passwords.

• Reset the admin enable password.

• Reset any stored application programming interface (API) keys.

• Reset the password of any local user defined on the gateway, including service accounts used for third-party integrated authentication configurations.

• If any credential stealers are identified on an appliance, reset the passwords for any users that authenticated to the appliance(s) during the period when the malware was active.

Hardening Measures

Besides aligning to the best security configuration practices, organisations can consider applying the following recommendations to further harden their systems:

• Restrict egress communications from the CS VPN appliance(s). This can mitigate the impact of command-and-control (C2) communications from any backdoors that are present on an appliance. 

• Disable administrative access to the CS VPN appliance(s) from the external (internet-facing) port. Administrator > Admin Realms > Select Realm > Authentication Policy > Source IP > Ensure that “Enable administrators to sign in on the External Port” is not enabled. 

• Minimise the scope of internal connectivity paths that could be leveraged for lateral movement from the management interface of CS VPN appliance(s). 

• If the appliance(s) are configured with a one-arm topology, the following hardening measures should be considered: 

• Enable Source IP Based Restrictions for the Administrator Realm. Administrators > Admin Realms > Admin Users > Authentication Policy > Source IP 

• Enable MFA for the administrator sign-in URL. 

• Configure the Management Port to allow administrators to sign in and disable administrators to sign in on the Internal Port. Administrators > Admin Realms > Admin Users > Authentication Policy > Administrator sign in ports 

• Disable Session Roaming, which can mitigate the impact of a stolen session cookie being reused by a different IP address that does not correlate to the initial user who logged in. 

• Users: Users > User Roles > > General > Session Options: Roaming Session, select "Disabled"

• Admins: Administrators > Admin Roles >> General > Session Options: Roaming Session, select "Disabled" 

• Enforce Session Lifetime Limits to reduce the risk of a stolen session being continuously reused by an attacker. 

• Users: Users > User Roles >> General > Session Options: Session lifetime lengths

• Admins: Administrators > Admin Roles > > General > Session Options: Session lifetime lengths

• Do not allow Persistent Sessions to reduce the risk of a stolen session being continuously reused by an attacker. 

• Users: Users > User Roles >> General > Session Options: Persistent Session, select "Disabled" 

• Admins: Administrators > Admin Roles >> General > Session Options: Persistent Session, select "Disabled" 

• Enable “Remove Browser Session Cookies” to reduce the risk of stealing browser session cookies. 

• Users: Users > User Roles >> General > Session Options: Remove Browser Session Cookie, select "Enabled" 

• Admins: Administrators > Admin Roles >> General > Session Options: Remove Browser Session Cookie, select "Enabled" 

• Enable “HTTP Only Device Cookie” to reduce the risk of cookie stealing. 

• Users: Users > User Roles >> General > Session Options: HTTP Only Device Cookie, select "Enabled" 

• Admins: Administrators > Admin Roles >> General > Session Options: HTTP Only Device Cookie, select "Enabled

Host and Network IOCs

Possible host and network Indicators of Compromise (IOCs) associated with the active campaign are shown in the tables below. Network administrators are advised to configure their firewall rules to block connections to the following network IOCs associated with the campaign while reviewing any prior connections and scan for the presence of the host-based IOCs in their systems.

Report a Compromise

Singapore organisations affected by these vulnerabilities should report to SingCERT if any evidence of compromise is found. A report can be made via our Incident Reporting Form at https://go.gov.sg/singcert-incident-reporting-form.

More information is available here:

• https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US

• https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

• https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US

• https://www.bleepingcomputer.com/news/security/cisa-emergency-directive-mitigate-ivanti-zero-days-immediately/

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

• Active exploitation of zero day vulnerabilities in ivanti connect secure and ivanti policy secure gateways

• Active exploitation of vulnerability in ivanti products