CVE-2024-21887

CVE-2024-21887 is a command injection vulnerability found in the web components of Ivanti Connect Secure and Ivanti Policy Secure, specifically in versions 9.x and 22.x. The Cyber Centre was made aware of this flaw, along with an authentication bypass vulnerability (CVE-2023-46805), on January 10, 2024. These vulnerabilities impact both Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) gateways. Details of targeted attacks exploiting these zero-day vulnerabilities were shared publicly by Volexity on the same day, highlighting the threat posed by UTA00178. The actors typically gain initial access by exploiting a public-facing networking device, such as Citrix Netscaler, F5 BIG-IP, Pulse Secure/Ivanti VPNs, or PanOS firewalls. The attack strategy involves using an exploit chain that combines an authentication bypass flaw (CVE-2023-46805) and a code injection vulnerability (CVE-2024-21887) to take control of susceptible instances. This vulnerability has been exploited in targeted attacks, as evidenced by attack traffic through Ivanti Connect Secure. Within one day of the release of a proof-of-concept (PoC) exploit for CVE-2024-21887, the group known as Magnet Goblin had malware containing the exploit ready. In fact, the new malware strain 'Skibidi' was found to be exploiting this vulnerability in Ivanti Connect Secure products, as well as another vulnerability in TP-Link Archer AX21 Wi-Fi routers. However, protection against this threat is available via the Check Point IPS blade, which covers Ivanti Authentication Bypass (CVE-2023-46805), Ivanti Command Injection (CVE-2024-21887), and Ivanti Server-Side Request Forgery (CVE-2024-21893).