31 January 2024

Ivanti warns of yet another zero-day in Connect Secure and Policy Secure products


Ivanti warns of yet another zero-day in Connect Secure and Policy Secure products

Ivanti has released a security advisory warning of two new vulnerabilities in its Connect Secure and Policy Secure products, one of which is being exploited in the wild.

The zero-day flaw in question (CVE-2024-21893) is a server-side request forgery (SSRF) issue that stems from insufficient validation of user-supplied input within the SAML component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. Successful exploitation of this vulnerability could allow a remote attacker to gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Ivanti has not shared info on the nature of the exploitation, only noting that “the exploitation of CVE-2024-21893 appears to be targeted” and that it expects “a sharp increase in exploitation once this information is public.”

The second vulnerability discovered as part of the ongoing investigation into CVE-2023-46805 and CVE-2024-21887, exploited by the China-linked threat actor tracked as UNC5221/UTA0178, is a privilege escalation flaw (CVE-2024-21888) that could allow a remote user to bypass implemented security restrictions and gain administrative privileges. Currently, there’s no indication that this vulnerability is being exploited in the wild.

Following public disclosure, CVE-2023-46805 and CVE-2024-21887 have come under mass exploitation by other threat actors to drop XMRig cryptocurrency miners as well as Rust-based payloads. Security researchers have also spotted a new version of one of the web shells known as Wirefire (aka Giftedvisitor) leveraged by a Chinese threat actor in attacks targeting Ivanti Connect Secure zero-days. This version was modified to bypass detection mechanisms and to avoid detections by public YARA rules.

In addition, Synacktiv researchers observed threat actors exploiting CVE-2023-46805 and CVE-2024-21887 to deliver a Rust-based malware called “KrustyLoader” to deploy Sliver, a Golang-based cross-platform post-exploitation framework used by malicious actors as an alternative to the Cobalt Strike tool.

Back to the list

Latest Posts

Cyber Security Week in Review: May 24, 2024

Cyber Security Week in Review: May 24, 2024

In brief: Google fixes Chrome zero-day, a backdoor found in JAVS software, and more.
24 May 2024
Chinese APTs increasingly using ORB networks to mask attack infrastructure

Chinese APTs increasingly using ORB networks to mask attack infrastructure

Mandiant reports that it is actively monitoring several ORB networks, with the most notable being SPACEHOP and FLORAHOX.
23 May 2024
Threat actors exploit vulnerable drivers to disable EDRs in cryptojacking attack

Threat actors exploit vulnerable drivers to disable EDRs in cryptojacking attack

Ghostengine deploys several modules to tamper with security tools, establish a backdoor, and ensure software updates are in place.
22 May 2024