PT-2023-8231 · Ivanti · Ivanti Policy Secure +1

Published 2023-01-24 · Updated 2025-09-08 · CVE-2024-21887

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

Ivanti Connect Secure versions 9.0 through 9.1 and 22.1 through 22.3

Ivanti Policy Secure versions 9.0 through 9.1 and 22.1 through 22.3

**Description:**

A command injection vulnerability exists in the web components of Ivanti Connect Secure and Ivanti Policy Secure. This flaw allows an authenticated administrator to send specially crafted requests, resulting in the execution of arbitrary commands on the appliance. The vulnerability is actively exploited in the wild by threat actors, including the Magnet Goblin group and Chinese state-sponsored APT actors. These actors have been observed using the vulnerability to gain access to systems, modify network settings, establish covert tunnels, and exfiltrate data. Approximately 800 vulnerable IPs remain exposed. The exploitation of this vulnerability has been linked to the deployment of Rust-based backdoors and the "KrustyLoader" malware.

**Recommendations:**

Ivanti Connect Secure versions 9.0 through 9.1 and 22.1 through 22.3: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Ivanti Policy Secure versions 9.0 through 9.1 and 22.1 through 22.3: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-00249

CVE-2024-21887

Affected Products

Ivanti Connect Secure

Ivanti Policy Secure

References · 450

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2024-21887 · Exploit
• 🔥 https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887 · Exploit
• 🔥 https://github.com/seajaysec/Ivanti-Connect-Around-Scan · Exploit
• 🔥 https://github.com/yoryio/CVE-2023-46805_CVE-2024-21887_Scanner · Exploit
• 🔥 https://github.com/oways/ivanti-CVE-2024-21887 · Exploit
• 🔥 https://github.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887 · Exploit
• 🔥❌ https://github.com/rxwx/pulse-meter · Exploit, Deleted
• 🔥❌ https://github.com/TheRedDevil1/Check-Vulns-Script · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-21887 · Security Note
• https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00249 · Security Note
• https://github.com/volexity/threat-intel/blob/main/2024/2024-01-10%20Ivanti%20Connect%20Secure/indicators/iocs.csv · Note