CVE-2024-21893highunder attackransomwareCWE-918

CVE-2024-21893: high-severity vulnerability in Ivanti ICS

Published · Updated

Follow this CVE+ Monitor Connect Secure+ Monitor Policy Secure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 8.2epss 100%
from disclosure to weapon2 days
Published on NVDJan 31
1st PoC+2d
metasploitJan 31
CISA KEVJan 31
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 02/2024Atualizações sobre vulnerabilidades em produtos Volexity Ivantiread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-02-02

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in the SAML component of Ivanti Connect Secure and Policy Secure allows attackers to make the server fetch restricted resources on their behalf without needing to log in. This bypasses access controls that should protect sensitive data.

Technical detail

Server-side request forgery (SSRF) in the SAML processing logic of Ivanti Connect Secure, Policy Secure, and Neurons for ZTA (versions 9.x, 22.x) enables unauthenticated attackers to force the server to request restricted resources. The vulnerability stems from insufficient validation of SAML-controlled requests, allowing access to protected endpoints and data without prior authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
Ivanti · ICSIvanti · IPS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ivanti ICS

In the same product, most dangerous first.

CVE-2024-21887CRITICALCVE-2024-21887EPSS 100.0%KEVCVE-2023-46805HIGHCVE-2023-46805EPSS 100.0%KEVCVE-2024-22024HIGHCVE-2024-22024EPSS 94.7%CVE-2024-21888HIGHCVE-2024-21888EPSS 85.4%