Date: 14/2/2024 | Prepared by: Joel D'Souza, Vulnerability Security Analyst
This bulletin aims to address recently disclosed CRITICAL-risk vulnerabilities present in Ivanti products.
Previously, Triskele Labs released a bulletin addressing vulnerabilities in Ivanti for CVE-2023-46805 and CVE-2024-21887.
Since then, several more vulnerabilities have been discovered in this product. This bulletin captures all issues discovered thus far.
The disclosed vulnerabilities allow potential attackers to capture credentials, drop webshells, and escalate privileges.
As such, Triskele Labs advises that all organisations using affected versions of Ivanti follow the remediation steps outlined in the subsequent sections provided by the US Cybersecurity and Infrastructure Security Agency (CISA) to mitigate the threat associated with vulnerable versions of these devices.
The Triskele Labs Digital Forensics and Incident Response (DFIR) team has responded to incidents in which Ivanti exploitation has been used to gain initial access to networks, and Triskele Labs is aware of Threat Actors exploiting these vulnerabilities on a mass scale to collect credentials and obtain persistence.
On 01 February 2024, the Australian Cyber Security Centre (ACSC) released an updated vulnerability disclosure focused on CVE-2023-46805 and CVE-2024-21887, with the recommendation that all organisations should patch the affected devices as a priority as the vendor was aware of active exploitation.
On 09 February 2024, the US Cybersecurity and Infrastructure Security Agency (CISA) updated its advisory regarding Ivanti Connect Secure and Policy Secure Gateways to reflect three additional vulnerabilities (CVE-2024-21888, CVE-2024-21893, CVE-2024-22024). Additionally, CISA issued version 2 of its Supplemental Direction to its Emergency Directive regarding the containment of these devices across all government agencies.
The following vulnerabilities have been recently disclosed or updated by the vendor:
Specific information around each of these vulnerabilities can be found in the resources listed in the References section.
CISA indicated that these vulnerabilities have been used to compromise enterprise networks, with instances of sophisticated threat actors bypassing the external Integrity Checker Tool (ICT) to evade detection.
Proof-of-concepts for several of these vulnerabilities have been publicly released, with a large amount of them targeting CVE-2024-21893, according to the Shadowserver Foundation.
The attack paths for each of these vulnerabilities could be used for credential harvesting, network traversal, and privilege escalation without detection. Once these attacks are performed, the Triskele Labs DFIR team often sees this result in full network compromise.
Due to the criticality of these vulnerabilities and their potential exploitation, devices using affected versions of Ivanti should be treated as an optimal target for a threat actor and patched as a priority for the business, to prevent exfiltration of data and leakage of Personally Identifiable Information (PII), and other sensitive data.
If you are utilising an Ivanti device impacted by this vulnerability, Triskele Labs recommends reviewing firewall logs and other related or relevant log sources for unusual activity.
Ivanti has released software updates for all the affected Ivanti Connect Secure and Policy Secure Gateway vulnerabilities in Ivanti devices.
CISA provided the following steps for mitigation of these threats as a mandate for US federal agencies.
However, they highly recommend other businesses and organisations use these steps to ensure the threat posed by these vulnerabilities is reduced.
1. Organisations should disconnect instances of Ivanti Connect Secure and Ivanti Policy Secure solution products immediately and follow the set of instructions listed here before bringing any product back into service. For all affected products:Ivanti KB and customer portal for directions on how to remove the mitigations after upgrading.
E. Revoke and reissue any connected or exposed certificates, keys, and passwords, to include the following:
3. For all products returned to service, apply future updates that address the vulnerabilities as they become available and no later than 48 hours following their release by Ivanti.
4. Organisations running the affected products must assume domain accounts associated with the affected products have been compromised. The following steps should be performed to ensure that credentials are rotated:
Please refer to the following resources for additional recovery steps from Ivanti:
Triskele Labs recommends upgrading to the latest version of Ivanti Connect Secure and Ivanti Policy Secure immediately using the steps provided by CISA to ensure permanent mitigation.
Triskele Labs DefenceShield customers with Assess service (Vulnerability Scanning) are currently being scanned. All customers with our Monitor service (24x7x365 Managed Detection and Response) are - as always - being monitored closely for related Indicators of Compromise (IOCs) and Tactics, Techniques and Procedures (TTPs).
References used for the generation of this release:
