Exploit for #VU85962 Server-Side Request Forgery (SSRF) in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure)

Exploit for #VU85962 Server-Side Request Forgery (SSRF) in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure)

Published: 2024-02-08 | Updated: 2024-04-05

Vulnerability identifier: #VU85962

Vulnerability risk: Critical

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-21893

CWE-ID: CWE-918

Exploitation vector: Network

Exploits in database: 3

April 5, 2024
- Ivanti-Connect-Around-Scan (Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.) [Github]
February 21, 2024
- Ivanti Connect Secure Unauthenticated Remote Code Execution [Metasploit]
February 8, 2024
- CVE-2024-21893-to-CVE-2024-21887 [Github]

Impact: Information disclosure and data manipulation

Vulnerable software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Server applications / Remote access servers, VPN
Ivanti Policy Secure (formerly Pulse Policy Secure)
Server applications / Remote access servers, VPN

Vendor: Ivanti