CVE-2024-21893

CVE-2024-21893 is a server-side request forgery (SSRF) vulnerability, a flaw in software design or implementation within Ivanti's products. This particular vulnerability has been exploited in targeted attacks as a zero-day, which means it was used by attackers before the vendor became aware of and patched it. Alongside this, Ivanti disclosed another privilege escalation vulnerability in the Web component of Ivanti Connect Secure and Ivanti Policy Secure (CVE-2024-21888), although this hasn't been observed in any attacks yet. Despite patches for these vulnerabilities being released on January 31, with one even addressed earlier, attackers have continued to exploit them. Specifically, they've leveraged CVE-2024-21893 to deploy new malware families such as LittleLamb.WoolTea, PitStop, Pitdog, PitJet, and PitHook. This suggests that systems running Ivanti's affected software may still be at risk if they haven't applied the necessary patches. To mitigate these threats, Check Point Harmony IPS provides protection against CVE-2024-21893. Additionally, the Check Point IPS blade offers protection against a range of Ivanti-related threats, including an Authentication Bypass (CVE-2023-46805), Command Injection (CVE-2024-21887), and the aforementioned Server-Side Request Forgery (CVE-2024-21893). Therefore, organizations are encouraged to apply both the vendor-provided patches and utilize these security measures to enhance their defensive posture against potential cyberattacks.