# Ivanti gateways exploited in active attacks via auth-bypass chain

Published: 2025-07-17 · Severity: high · Sectors: defense, financial-services, government-national, healthcare, infrastructure, technology, telecommunications
Canonical: https://vorant.io/reports/5ee7df71-643f-5239-a723-3a0cbedc143f/ivanti-gateways-exploited-in-active-attacks-via-auth-bypass-chain

> Threat actors actively exploit three Ivanti vulnerabilities to bypass authentication, execute commands, and persist despite factory resets.

Cyber threat actors are actively exploiting CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 in Ivanti Connect Secure and Policy Secure gateways (versions 9.x and 22.x). The vulnerabilities can be chained to enable unauthenticated remote code execution, web shell deployment (GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE, CHAINLINE variants), and credential harvesting. Post-compromise, actors leverage native tools (freerdp, ssh, telnet, nmap) for lateral movement and domain compromise.

CISA's independent lab research confirms that Ivanti's Integrity Checker Tool (ICT) fails to detect compromise reliably. Attackers can maintain root-level persistence despite factory resets and upgrades by storing malicious code on encrypted partitions, overwriting files, and time-stomping to appear clean. Domain administrator cleartext credentials and NTLM hashes stored on the appliance can be exfiltrated via root access, enabling full domain takeover.

Defenders must assume all credentials stored on affected appliances are compromised and conduct aggressive threat hunting. Organizations should treat continued operation of these gateways as carrying unacceptable risk until comprehensive patching and incident response are complete.

## Mentioned in this report

- Vulnerabilities: CVE-2023-46805 (KEV), CVE-2024-21887 (KEV), CVE-2024-21888 (weaponized), CVE-2024-21893 (KEV), CVE-2024-22024 (templated)
- Malware: BUSHWALK, CHAINLINE, GIFTEDVISITOR, GLASSTOKEN, LIGHTWIRE

## Detection guidance (public sample)

### Ivanti Connect Secure Auth Bypass via TOTP Backup-Code Path Traversal

ATT&CK: T1190

Web requests to the Ivanti /api/v1/totp/user-backup-code endpoint containing path traversal sequences, the CVE-2023-46805 authentication bypass pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ivanti Connect Secure Auth Bypass via TOTP Backup-Code Path Traversal
description: Detects requests to the Ivanti Connect/Policy Secure REST API where the
  user-backup-code path is followed by directory traversal (plain or encoded) to reach
  otherwise protected endpoints. This is the authentication bypass step (CVE-2023-46805)
  of the exploit chain.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - /api/v1/totp/user-backup-code/../
    - /api/v1/totp/user-backup-code/..%2f
    - /api/v1/totp/user-backup-code/%2e%2e
  condition: selection
falsepositives:
- Authorised vulnerability scanners or red-team exercises testing for CVE-2023-46805
level: high
id: a1e30e8f-14f7-58c1-890b-b9a0203c7f92
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
```

### Ivanti License API Command Injection Attempt

ATT&CK: T1190

Requests to the Ivanti /api/v1/license/keys-status/ endpoint with shell metacharacters appended to the path, the CVE-2024-21887 command injection pattern used for RCE and web shell deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ivanti License API Command Injection Attempt
description: Detects requests to the Ivanti license keys-status API where a semicolon
  (plain or URL-encoded) follows the endpoint path, indicating command injection (CVE-2024-21887)
  that is typically chained after the auth bypass to gain code execution and drop
  web shells.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: /api/v1/license/keys-status/
  selection_inject:
    cs-uri-stem|contains:
    - ;
    - '%3b'
  condition: selection_path and selection_inject
falsepositives:
- Authorised vulnerability scanners or red-team exercises testing for CVE-2024-21887
level: high
id: dd15615e-bd05-5e84-b828-e58ee75c6081
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
```

### Web Server or Script Interpreter Spawning Network Recon or Remote Access Tools on Linux

ATT&CK: T1018

A web server or scripting interpreter parent spawning nmap, freerdp or telnet, matching post-exploitation lateral movement tooling used from compromised gateway appliances. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or Script Interpreter Spawning Network Recon or Remote Access Tools
  on Linux
description: Detects nmap, xfreerdp/freerdp or telnet launched by a web server or
  perl/python interpreter on Linux. After exploiting a public-facing gateway, actors
  used native tools such as freerdp, telnet and nmap for remote system discovery and
  lateral movement over RDP.
tags:
- attack.discovery
- attack.t1018
- attack.lateral-movement
- attack.t1021.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /nginx
    - /apache2
    - /php-fpm
    - /perl
    - /python
    - /python3
  selection_child:
    Image|endswith:
    - /nmap
    - /xfreerdp
    - /xfreerdp3
    - /freerdp
    - /telnet
  condition: selection_parent and selection_child
falsepositives:
- Network monitoring or inventory scripts written in Python or Perl that invoke nmap
- Web-based admin panels that deliberately wrap nmap for scanning
level: medium
id: c91ed2b9-9250-5f6e-bac8-aca42f610f12
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5ee7df71-643f-5239-a723-3a0cbedc143f/ivanti-gateways-exploited-in-active-attacks-via-auth-bypass-chain.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup