Ivanti gateways exploited in active attacks via auth-bypass chain
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Threat actors actively exploit three Ivanti vulnerabilities to bypass authentication, execute commands, and persist despite factory resets.
Cyber threat actors are actively exploiting CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 in Ivanti Connect Secure and Policy Secure gateways (versions 9.x and 22.x). The vulnerabilities can be chained to enable unauthenticated remote code execution, web shell deployment (GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE, CHAINLINE variants), and credential harvesting. Post-compromise, actors leverage native tools (freerdp, ssh, telnet, nmap) for lateral movement and domain compromise.
CISA's independent lab research confirms that Ivanti's Integrity Checker Tool (ICT) fails to detect compromise reliably. Attackers can maintain root-level persistence despite factory resets and upgrades by storing malicious code on encrypted partitions, overwriting files, and time-stomping to appear clean. Domain administrator cleartext credentials and NTLM hashes stored on the appliance can be exfiltrated via root access, enabling full domain takeover.
Defenders must assume all credentials stored on affected appliances are compromised and conduct aggressive threat hunting. Organizations should treat continued operation of these gateways as carrying unacceptable risk until comprehensive patching and incident response are complete.
Mentioned in this report
Detection guidance
Ivanti Connect Secure Auth Bypass via TOTP Backup-Code Path Traversal
Web requests to the Ivanti /api/v1/totp/user-backup-code endpoint containing path traversal sequences, the CVE-2023-46805 authentication bypass pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Connect Secure Auth Bypass via TOTP Backup-Code Path Traversal
description: Detects requests to the Ivanti Connect/Policy Secure REST API where the
user-backup-code path is followed by directory traversal (plain or encoded) to reach
otherwise protected endpoints. This is the authentication bypass step (CVE-2023-46805)
of the exploit chain.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- /api/v1/totp/user-backup-code/../
- /api/v1/totp/user-backup-code/..%2f
- /api/v1/totp/user-backup-code/%2e%2e
condition: selection
falsepositives:
- Authorised vulnerability scanners or red-team exercises testing for CVE-2023-46805
level: high
id: a1e30e8f-14f7-58c1-890b-b9a0203c7f92
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Ivanti License API Command Injection Attempt
Requests to the Ivanti /api/v1/license/keys-status/ endpoint with shell metacharacters appended to the path, the CVE-2024-21887 command injection pattern used for RCE and web shell deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti License API Command Injection Attempt
description: Detects requests to the Ivanti license keys-status API where a semicolon
(plain or URL-encoded) follows the endpoint path, indicating command injection (CVE-2024-21887)
that is typically chained after the auth bypass to gain code execution and drop
web shells.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: /api/v1/license/keys-status/
selection_inject:
cs-uri-stem|contains:
- ;
- '%3b'
condition: selection_path and selection_inject
falsepositives:
- Authorised vulnerability scanners or red-team exercises testing for CVE-2024-21887
level: high
id: dd15615e-bd05-5e84-b828-e58ee75c6081
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Web Server or Script Interpreter Spawning Network Recon or Remote Access Tools on Linux
A web server or scripting interpreter parent spawning nmap, freerdp or telnet, matching post-exploitation lateral movement tooling used from compromised gateway appliances. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or Script Interpreter Spawning Network Recon or Remote Access Tools
on Linux
description: Detects nmap, xfreerdp/freerdp or telnet launched by a web server or
perl/python interpreter on Linux. After exploiting a public-facing gateway, actors
used native tools such as freerdp, telnet and nmap for remote system discovery and
lateral movement over RDP.
tags:
- attack.discovery
- attack.t1018
- attack.lateral-movement
- attack.t1021.001
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /nginx
- /apache2
- /php-fpm
- /perl
- /python
- /python3
selection_child:
Image|endswith:
- /nmap
- /xfreerdp
- /xfreerdp3
- /freerdp
- /telnet
condition: selection_parent and selection_child
falsepositives:
- Network monitoring or inventory scripts written in Python or Perl that invoke nmap
- Web-based admin panels that deliberately wrap nmap for scanning
level: medium
id: c91ed2b9-9250-5f6e-bac8-aca42f610f12
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs