Back to Vulnerability Database
    criticalAC-IVANTI-2024· 4 exploit paths

    Ivanti Connect Secure: Auth Bypass + Command Injection

    An SSL-VPN appliance chain turning two bugs into perimeter RCE.

    CVE-2023-46805→
    CVE-2024-21887
    THE PRIMARY LESSON:

    Edge devices are still where chains land. An SSL-VPN appliance is a highly coveted entry point into the internal network, chaining a 'just' auth bypass with a 'just' admin command injection collapses the perimeter and gives attackers a foothold into sensitive systems.

    Chain Visualization

    Step-by-step exploitation flow. Each link compounds the next.

    1
    CVE-2023-46805High (CVSS 8.2)T1190 – Exploit Public-Facing Application

    Authentication Bypass via Path Traversal

    A path traversal in the web component bypasses access-control checks, granting unauthenticated access to restricted admin endpoints.

    Securin Risk: 8.6CVSS: 8.2Discovered: Jan 10, 2024

    Yielded Result: Unauthenticated reach into authenticated admin APIs.

    2
    CVE-2024-21887Critical (CVSS 9.1)T1059 – Command and Scripting Interpreter

    Authenticated Command Injection

    Lets an authenticated admin send crafted requests that execute arbitrary OS commands on the appliance.

    Securin Risk: 9.5CVSS: 9.1Discovered: Jan 10, 2024

    Yielded Result: Arbitrary command execution on the VPN appliance, unauthenticated when chained.

    ULTIMATE THREAT ACTION OUTCOME

    Unauthenticated Remote Code Execution on perimeter VPN, enabling lateral movement into internal networks.

    Remediation Urgency: Emergency Mitigation & Integrity Checker ToolMass Exploitation Observed

    THREAT PROFILE

    Primary Target
    Ivanti Connect Secure & Policy Secure (SSL-VPN)
    Threat Actor Focus
    UNC5221 and other China-nexus espionage actors
    Era / Impact Timeline
    Released January 2024 (Active campaigns ongoing)

    MITRE ATT&CK MAPPING

    Enterprise Map
    1. Initial Access
      T1190 – Exploit Public-Facing Application
      Path traversal against the Ivanti web management interface.
    2. Execution
      T1059 – Command and Scripting Interpreter
      Authenticated command injection on the appliance OS.
    3. Lateral Movement
      T1021 – Remote Services
      Pivot from the SSL-VPN foothold into the internal network.
    4. Exfiltration
      T1041 – Exfiltration Over C2 Channel
      Sensitive data staged and exfiltrated via attacker C2.

    Explore other attack chains

    AC-PROXYSHELL
    ProxyShell
    Three Exchange flaws chain into unauthenticated RCE with SYSTEM privileges.
    AC-PROXYLOGON
    ProxyLogon
    Two Exchange bugs that, chained, became the year's worst email-server exploit.