CVE-2024-21887
CVE-2024-21887
In short
An authenticated administrator can send specially crafted requests to Ivanti Connect Secure or Policy Secure to execute arbitrary commands on the system. This allows an insider with admin access to take complete control of the appliance.
Technical detail
Command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Policy Secure (9.x, 22.x) allows authenticated administrative users to inject arbitrary OS commands via crafted HTTP requests, resulting in unauthenticated remote code execution on the appliance. The vulnerability requires valid administrator credentials as a precondition.
Summary generated and translated by AI from the official description.
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
public PoCs found — 9
githubgithub.com/Chocapikk/CVE-2024-21887★ 58githubgithub.com/duy-31/CVE-2023-46805_CVE-2024-21887★ 23githubgithub.com/seajaysec/Ivanti-Connect-Around-Scan★ 12githubgithub.com/oways/ivanti-CVE-2024-21887★ 7githubgithub.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser★ 5githubgithub.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887★ 5githubgithub.com/rxwx/pulse-meter★ 1githubgithub.com/pwniel/ivanti_shell★ 0cve_referencepacketstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.htmlhttps://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_UShttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887