CVE-2023-46805

CVE-2023-46805 is an authentication bypass vulnerability that affects all supported versions of Ivanti Connect Secure and Ivanti Policy Secure (versions 9.x and 22.x). The Cyber Centre first became aware of this flaw, along with a command injection vulnerability (CVE-2024-21887), on January 10, 2024. These vulnerabilities were exploited by threat actors to gain unauthorized access to Ivanti Connect Secure and Ivanti Policy Secure gateways. Software updates have since been made available to address these vulnerabilities. On February 29, the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about ongoing exploitation of these vulnerabilities in Ivanti devices. This alert was released to provide cyber defenders with new mitigations against threats exploiting these vulnerabilities. Notably, a nation-state actor breached systems by chaining these two Ivanti Connect Secure zero-day vulnerabilities in January 2024. The extent of the breach remains undisclosed by CISA, but it continues to urge organizations to heed its advisory. Protection against these threats is provided by Check Point IPS blade, which guards against the Ivanti Authentication Bypass (CVE-2023-46805), Ivanti Command Injection (CVE-2024-21887), and Ivanti Server-Side Request Forgery (CVE-2024-21893). Additionally, the Five Eyes alliance issued a warning about threat actors exploiting known security flaws in Ivanti Connect Secure and Ivanti Policy Secure gateways, including CVE-2023-46805 and CVE-2024-21887. It is essential for organizations to promptly apply the available software updates to mitigate these vulnerabilities and protect their systems.