CVE-2024-21887

CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2024-21887 is a command injection vulnerability in the web components of Ivanti Connect Secure and Ivanti Policy Secure. An authenticated administrator can send specially crafted requests that result in arbitrary command execution on the underlying appliance.

Background

Ivanti Connect Secure (formerly Pulse Secure Connect) is a widely deployed SSL VPN appliance that provides remote access to enterprise networks. Ivanti Policy Secure is a complementary network access control (NAC) solution. Both products expose web-based management interfaces for administrative configuration. Because these appliances sit at the network edge and terminate privileged remote-access sessions, they are high-value targets for threat actors.

Root Cause

The vulnerability is classified as CWE-77: Command Injection. User-controllable input from authenticated web requests is passed to an underlying system shell without adequate sanitization or parameterization. This allows an attacker to inject shell metacharacters and execute arbitrary operating-system commands with the privileges of the web service process.

Impact

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H yields a score of 9.1 (Critical).

• Attack Vector (AV:N): The vulnerability is exploitable over the network via the web interface.
• Attack Complexity (AC:L): Low complexity; no advanced conditions or race windows are required.
• Privileges Required (PR:H): The attacker must hold valid administrator credentials. While this limits the attack surface to insider or compromised-admin scenarios, the resulting impact is total.
• User Interaction (UI:N): No victim interaction is needed.
• Scope (S:C): A successful compromise can affect resources beyond the security scope of the vulnerable web component, because arbitrary command execution on the appliance allows lateral movement, traffic interception, and credential harvesting.
• Confidentiality, Integrity, Availability (C:H/I:H/A:H): Full command execution equates to complete compromise of the appliance.

Exploitation Walkthrough

Ethics caveat: This section is intended for defensive analysis and detection engineering only. Do not attempt to exploit this vulnerability against systems you do not own or have explicit authorization to test.

From a defensive perspective, exploitation proceeds as follows:

1. Authentication: The attacker authenticates to the appliance's web management interface using valid administrator credentials. This may occur through compromised credentials, credential stuffing, or session hijacking.
2. Request crafting: The attacker navigates to a web endpoint that accepts user input and passes that input to a backend shell command. The attacker injects shell metacharacters (for example, semicolons, backticks, or pipe characters) into the request parameters.
3. Command execution: The backend application constructs a shell command string that includes the attacker's input. Because the input is not properly escaped or parameterized, the shell interprets the injected metacharacters as command separators, executing the attacker's supplied commands.
4. Post-exploitation: With operating-system access, the attacker can read configuration files, extract VPN session cookies, install persistence mechanisms, proxy traffic into the internal network, or move laterally to adjacent infrastructure.

Defenders should focus on hardening admin access, enforcing multi-factor authentication, and monitoring for anomalous command-line activity originating from the appliance process.

Affected and Patched Versions

Affected versions (based on available CPE data):

• Ivanti Connect Secure: 9.0, 9.1 (r1 through r18), 22.1 (r1, r6), 22.2, 22.3 (r1), 22.4 (r1, r2.1), 22.5 (r2.1), 22.6 (r1, r2)
• Ivanti Policy Secure: 9.0, 9.1 (r1 through r18), 22.1 (r1, r6), 22.2 (r1, r3), 22.3 (r1, r3), 22.4 (r1, r2, r2.1), 22.5 (r1, r2.1), 22.6 (r1)

Patched versions are not specified in the available source data. Organizations should consult the Ivanti security advisory referenced below for the latest patched releases and deployment guidance.

Remediation

1. Patch immediately: Because this vulnerability is actively exploited (CISA KEV) and carries a near-maximum EPSS score, treat patching as an emergency change. Apply the latest vendor-released firmware for Connect Secure and Policy Secure as soon as it is validated in your environment.
2. Compensating controls:
   • Restrict administrative access to the management interface to a dedicated, tightly controlled jump host or out-of-band management network.
   • Enforce strong, unique administrator credentials and phishing-resistant multi-factor authentication (MFA) for all admin accounts.
   • Deploy a Web Application Firewall (WAF) or reverse proxy in front of the management interface with rules that detect common command-injection patterns.
   • Disable or remove unused administrative accounts and features.

Detection

• Monitor web server and appliance logs for unusual administrator requests that contain shell metacharacters or unexpected parameter values.
• Correlate endpoint or host-based telemetry from the appliance for anomalous process spawning, unexpected outbound network connections, or file-system modifications initiated by the web service process.
• Review authentication logs for logins from unfamiliar source IPs or atypical times, which may indicate compromised administrator credentials.
• If the appliance supports integrity monitoring, alert on unauthorized changes to system binaries or configuration files.

Assessment

CVE-2024-21887 presents an exceptionally high risk in practice. The EPSS score of 0.99999 places it in the top exploitation probability tier, and its inclusion in the CISA Known Exploited Vulnerabilities catalog with an exploitation start date of 2024-01-10 confirms in-the-wild abuse. When combined with the adjacent authentication-bypass vulnerability CVE-2023-46805, the effective privileges required can drop from "High" to "None," making this a full unauthenticated remote-code-execution chain.

Key lessons:

1. Edge appliances are crown-jewel targets. A command-injection flaw in a VPN gateway management interface is not merely a local admin issue; it is a direct path to full network compromise.
2. High EPSS + KEV = emergency patching. Waiting for a standard maintenance window is not advisable when exploitation is statistically certain and already observed in the wild. Organizations should have an emergency patch procedure for network-edge devices.

References

• http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
• https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887