OS Command Injection in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2024-21887
Published: January 10, 2024 / Updated: June 21, 2024
Vulnerability identifier: #VU85287
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21887
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation. A remote authenticated administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system. However this vulnerability can be exploited by a non-authenticated attacker using authentication bypass vulnerability #VU85286 (CVE-2023-46805).
Note, the vulnerability is being actively exploited in the wild.
Affected software
Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
How to mitigate CVE-2024-21887
Install update from vendor's website.
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1
Links to Public Exploits and PoC-codes
- Exploit #10073 - CVE-2023-46805_CVE-2024-21887 (An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.) (June 21, 2024)
- Exploit #9840 - CVE-2023-46805_CVE-2024-21887_scan_grouped (May 23, 2024)
- Exploit #9799 - CVE-2023-46805_CVE-2024-21887 (The script in this repository only checks whether the vulnerabilities specified in the Ivanti Connect Secure product exist.) (May 13, 2024)
- Exploit #9730 - ivanti-CVE-2024-21887 (April 19, 2024)
- Exploit #9555 - Ivanti Connect Secure Unauthenticated Remote Code Execution (February 21, 2024)
- Exploit #9550 - CVE-2024-21887 (Ivanti Connect Secure & Ivanti Policy Secure allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance. (RCE Exploits)) (February 13, 2024)
- Exploit #9516 - Ivanti Connect Secure Unauthenticated Remote Code Execution (January 19, 2024)
External References
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
- https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US