PT-2024-1620 · Ivanti · Zta Gateways+2

Published 2024-01-31 · Updated 2025-10-31 · CVE-2024-22024

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions 9.x through 22.x Ivanti Policy Secure versions 9.x through 22.x ZTA gateways version 22.6R1.3 and earlier

Description The issue is an XML external entity (XXE) vulnerability in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways. This vulnerability allows an attacker to access certain restricted resources without authentication. The estimated number of potentially affected devices worldwide is over 20,000 ICS VPN gateways. There have been reports of significant scanning activity seeking devices vulnerable to this issue, with over 240,000 requests and 30,000 hosts targeted. Attack traffic has been observed from 11 different countries. The vulnerability can be exploited by sending a malicious SAML request to the vulnerable device, specifically to the "/dana-na/auth/saml-sso.cgi" endpoint with a SAMLRequest parameter.

Recommendations For Ivanti Connect Secure versions 9.x through 22.x: Update to the latest version that includes the patch for this vulnerability. For Ivanti Policy Secure versions 9.x through 22.x: Update to the latest version that includes the patch for this vulnerability. For ZTA gateways version 22.6R1.3 and earlier: Update to version 22.6R1.3 or later, which includes the patch for this vulnerability. As a temporary workaround, consider restricting access to the SAML component until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-01287

CVE-2024-22024

Affected Products

Ivanti Connect Secure

Ivanti Policy Secure

Zta Gateways

References · 120

• 🔥 https://github.com/0dteam/CVE-2024-22024 · Exploit
• https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22024 · Security Note
• https://bdu.fstec.ru/vul/2024-01287 · Security Note
• https://github.com/elceef/dnstwist · Note
• https://github.com/WithSecureLabs/lolcerts · Note
• https://twitter.com/collysucker/status/1755912922516087208 · Twitter Post
• https://twitter.com/DailyDarkWeb/status/1757790571047850394 · Twitter Post
• https://t.me/avleonovcom/1207 · Telegram Post
• https://twitter.com/fletch_ai/status/1763068351465538012 · Twitter Post
• https://twitter.com/wiz_io/status/1756082025407053944 · Twitter Post
• https://t.me/aptreports/22858 · Telegram Post
• https://t.me/zerodayalert/167 · Telegram Post
• https://twitter.com/CVEnew/status/1757257626839077043 · Twitter Post