XXE in Ivanti Connect Secure and Policy Secure

1) XML External Entity injection

EUVDB-ID: #VU86282

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-22024

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files and manipulate data on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Ivanti Connect Secure (formerly Pulse Connect Secure): before 22.6R2.2

Ivanti Policy Secure (formerly Pulse Policy Secure): before 22.5R1.2

External links

http://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.