CVE-2024-21887

What it actually does

CVE-2024-21887 is a command injection flaw in Ivanti Connect Secure and Ivanti Policy Secure web components. An authenticated administrator can submit specially crafted HTTP requests that cause the appliance to execute attacker-controlled operating system commands. In real-world campaigns, this flaw has commonly been chained with authentication bypass vulnerabilities so that attackers do not need valid administrator credentials. Successful exploitation can allow command execution on the VPN/security appliance, deployment of web shells or backdoors, credential theft, configuration theft, persistence, lateral movement, and full compromise of the appliance.

Why it matters to the business

Because these products commonly sit at the network edge and broker remote access, compromise can expose internal networks, user credentials, VPN sessions, and sensitive configuration data. This vulnerability is listed in CISA KEV, has an EPSS score near certainty, is reported as actively exploited in the wild, and has been associated with ransomware activity; the CISA remediation deadline of 2024-01-22 has long passed. Organizations still running affected Ivanti Connect Secure or Ivanti Policy Secure versions should treat exposure as a high-likelihood compromise scenario, not merely a patching issue.

How an attack unfolds

An attacker first identifies an exposed Ivanti Connect Secure or Ivanti Policy Secure appliance. If the attacker has administrator access, they can directly submit a crafted request to a vulnerable web component. In observed campaigns, attackers often chain this vulnerability with an authentication bypass to reach the vulnerable functionality without valid credentials. The malicious request injects shell metacharacters or command syntax into a parameter processed by the appliance, causing the underlying system to execute arbitrary commands. The attacker then typically runs reconnaissance commands, writes or modifies web-accessible files, deploys a web shell or passive backdoor, downloads tooling, extracts configuration and credential material, and uses the VPN appliance as a foothold into downstream systems. Espionage, cryptomining, and financially motivated actors have exploited this vulnerability class, and exploitation has been associated with ransomware campaigns.

How to fix it

Upgrade affected Ivanti Connect Secure and Ivanti Policy Secure 9.x and 22.x appliances to a vendor-supported fixed release or hotfix according to the latest Ivanti advisory. If immediate patching is not possible, apply the Ivanti-provided mitigation XML or equivalent vendor mitigation only as a temporary control, then patch as soon as possible. Restrict administrative interfaces to trusted management networks, require MFA for administrators, and remove direct internet exposure where feasible. Because this vulnerability has been actively exploited, any exposed or suspect appliance should be treated as potentially compromised: run Ivanti Integrity Checker Tool guidance, preserve forensic evidence where required, perform a factory reset or clean rebuild if compromise is suspected or confirmed, then apply the fixed version before returning the appliance to service. Rotate local administrator credentials, service credentials, VPN credentials, API keys, certificates, SAML signing material, LDAP bind credentials, and any other secrets that may have been accessible from the appliance.

How to confirm the fix worked

Confirm the appliance is running a fixed Ivanti-supported build or hotfix level from the administrative console and by comparing the exact version against the current Ivanti advisory. Verify that temporary mitigations are applied only where patching is pending and that they have not been removed or overwritten. Run the Ivanti Integrity Checker Tool, including the external/offline checker where appropriate, and review any failed integrity checks, unexpected file changes, or suspicious web artifacts. Confirm administrative web access is restricted to trusted networks. Review web access logs for requests to vulnerable API paths and command injection metacharacters. Where authorized, perform a controlled validation test to ensure crafted command-injection payloads are rejected and do not result in command execution.

Typical attack path

1. Scan the internet for exposed Ivanti Connect Secure or Ivanti Policy Secure appliances.
2. Fingerprint the appliance version and exposed web components.
3. Authenticate as an administrator or chain with an authentication bypass to reach administrative functionality.
4. Send a crafted HTTP request containing command injection syntax to the vulnerable web component.
5. Execute operating system commands on the appliance.
6. Deploy a web shell, backdoor, or command-and-control mechanism.
7. Collect appliance configuration, session, certificate, SAML, LDAP, VPN, and credential material where accessible.
8. Create persistence, modify files, or tamper with logs to evade detection.
9. Use the compromised VPN/security appliance to access internal resources.
10. Conduct follow-on activity such as espionage, cryptomining, data theft, or ransomware staging.

How to detect it

Investigate both direct exploitation and post-exploitation activity. Review Ivanti web access logs, administrator audit logs, authentication logs, VPN session logs, system integrity reports, configuration-change history, DNS/proxy/firewall egress logs, and any EDR or network telemetry covering the appliance or adjacent systems. Look for requests to administrative API endpoints containing shell metacharacters, URL-encoded command separators, command substitution syntax, or suspicious parameters. Pay special attention to exploitation chains involving unauthenticated access followed by administrative API use. Search for unexpected files under web-accessible Ivanti directories, modified Perl/CGI/JavaScript files, unusual child processes spawned by web services, outbound connections from the appliance to unfamiliar IPs, and use of common download or shell utilities. Run Ivanti Integrity Checker Tool and treat unexpected modifications as high-priority evidence. Because multiple espionage, cryptomining, and financially motivated campaigns have targeted this vulnerability, also hunt for credential use after the appliance was exposed, including new VPN sessions, impossible travel, unusual administrator logins, and lateral movement originating from VPN pools.

• /api/v1/totp/user-backup-code
• POST /api/v1/totp/user-backup-code
• GET /api/v1/totp/user-backup-code
• %3B
• %7C
• %60
• %24%28
• ;wget
• ;curl
• |wget
• |curl
• `wget
• `curl
• $(wget
• $(curl
• /bin/sh -c
• bash -c
• python -c
• perl -e
• nc -e
• mkfifo
• /home/webserver/htdocs/dana-na/auth/lastauthserverused.js
• /home/webserver/htdocs/dana-na/auth/compcheckresult.cgi
• /home/perl/DSLogConfig.pm
• Ivanti Integrity Checker
• Integrity Checker Tool

What your security team should do

• Immediately identify all Ivanti Connect Secure and Ivanti Policy Secure appliances, including internet-facing and third-party-managed instances.
• Prioritize remediation as emergency work: this vulnerability is in CISA KEV, has known in-the-wild exploitation, has ransomware association, and the KEV due date has passed.
• Patch or upgrade all affected appliances to a fixed vendor-supported release; use vendor mitigations only as a short-term bridge.
• Run Ivanti Integrity Checker Tool and investigate any unexpected file or integrity changes.
• If the appliance was internet-facing during the exploitation window, assume compromise is plausible and initiate incident response procedures.
• Collect and preserve appliance logs, configuration exports, and forensic artifacts before factory reset or rebuild when possible.
• Rotate credentials, certificates, SAML keys, API tokens, and service account secrets that may have been stored on or accessible through the appliance.
• Hunt for post-exploitation activity such as new web files, unusual outbound connections, suspicious administrative logins, credential dumping, and unexpected VPN sessions.
• Restrict administrative access to management networks and enforce MFA for all administrative users.
• Monitor for lateral movement from VPN address pools and appliance management networks into internal systems.