Ivanti Connect Secure multiple RCE and auth bypass flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple critical vulnerabilities in Ivanti VPN gateways allow unauthenticated remote code execution; active exploitation observed in Japan.
Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure VPN gateways contain multiple critical vulnerabilities that allow unauthenticated remote attackers to execute arbitrary commands and bypass authentication. The primary vulnerabilities are CVE-2024-21887 (remote code execution), CVE-2023-46805 (authentication bypass), CVE-2024-21888 (privilege escalation), CVE-2024-21893 (server-side request forgery), and CVE-2024-22024 (XML external entity injection in SAML component). As of February 2024, patches have been released for all supported versions (including versions 22.x and 9.x). Active exploitation has been confirmed in Japan as of January 2024, with potential for widespread impact. Defenders should immediately apply patches or implement mitigation measures if patching is not immediately possible. Ivanti provides an Integrity Checker Tool for detecting compromise, and detailed recovery procedures are available from the vendor.
Mentioned in this report
Detection guidance
Ivanti Connect Secure Authentication Bypass via Path Traversal in totp Backup-Code API
Detects web requests to the Ivanti Connect Secure/Policy Secure REST API that use path traversal after the user-backup-code endpoint to reach protected API paths without authentication (CVE-2023-46805 pattern). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Connect Secure Authentication Bypass via Path Traversal in totp Backup-Code
API
description: Detects requests to the Ivanti Connect Secure/Policy Secure /api/v1/totp/user-backup-code
endpoint that contain directory traversal sequences, used to bypass authentication
and reach restricted API endpoints (CVE-2023-46805 pattern). Matches the traversal
technique, not a specific target path.
tags:
- attack.initial-access
- attack.t1190
- attack.t1133
- cve.2023-46805
logsource:
category: webserver
detection:
selection_base:
cs-uri-stem|contains: /api/v1/totp/user-backup-code/
selection_traversal:
cs-uri-stem|contains:
- /../
- /..;/
- '%2e%2e'
- ..%2f
condition: selection_base and selection_traversal
falsepositives:
- Authorised vulnerability scanners or red-team exercises probing the appliance for
CVE-2023-46805
level: high
id: 2e931a12-3aee-5c9a-a0a1-fc1b084e7ce1
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2023/20240111.html
Ivanti Connect Secure Command Injection via License keys-status API
Detects requests to the Ivanti license keys-status API with a shell metacharacter (semicolon) appended to the path, indicating command injection (CVE-2024-21887 pattern), typically chained with the auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Connect Secure Command Injection via License keys-status API
description: Detects requests to /api/v1/license/keys-status/ followed by a semicolon
(raw or URL-encoded) and a command payload, characteristic of the CVE-2024-21887
command injection on Ivanti Connect Secure and Policy Secure. Often chained after
the CVE-2023-46805 authentication bypass.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1133
- cve.2024-21887
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- /api/v1/license/keys-status/;
- /api/v1/license/keys-status/%3b
- /api/v1/license/keys-status/%3B
condition: selection
falsepositives:
- Authorised vulnerability scanners or red-team exercises testing for CVE-2024-21887
level: high
id: 51eed172-5873-58db-bd0f-9a712a9367c7
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2023/20240111.html
Ivanti Connect Secure Chained Auth Bypass and Command Injection Requests
Detects requests combining the totp user-backup-code traversal with the license keys-status endpoint in a single URI, the single-request chain used to achieve unauthenticated command execution on Ivanti appliances. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Connect Secure Chained Auth Bypass and Command Injection Requests
description: Detects a single request URI that traverses from the totp user-backup-code
endpoint into the license keys-status endpoint, the chained CVE-2023-46805 and CVE-2024-21887
exploitation pattern giving unauthenticated command execution on Ivanti Connect
Secure/Policy Secure.
tags:
- attack.initial-access
- attack.t1190
- attack.t1133
- attack.privilege-escalation
- attack.t1548
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains|all:
- /api/v1/totp/user-backup-code/
- /license/keys-status/
condition: selection
falsepositives:
- Security scanners replaying public proof-of-concept requests against the appliance
level: critical
id: ad3b58d3-a3ae-58e1-89e8-4d1a617d01f9
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2023/20240111.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/20240111.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs