CVE-2024-21893

What it actually does

CVE-2024-21893 is an unauthenticated server-side request forgery vulnerability in the SAML processing component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. A remote attacker can cause the appliance to issue crafted requests from the appliance itself to restricted local or internal resources that are not normally reachable without authentication. Because the request originates from the trusted appliance, the flaw can expose sensitive internal API responses and, in real-world intrusions, has been used as part of broader attack chains against Ivanti gateways.

Why it matters to the business

Successful exploitation can give attackers unauthorized access to sensitive gateway resources and can support follow-on compromise of VPN/ZTA infrastructure that protects remote access into an organization. Because these products commonly sit at the network edge and broker access to internal systems, compromise can lead to credential theft, persistence, internal reconnaissance, and disruption of secure remote access services. This vulnerability is listed in CISA KEV, has an EPSS score near 1.0, is known to be actively exploited in the wild, and is associated with ransomware activity, so exposed systems should be treated as an urgent remediation priority. CISA’s KEV remediation due date was 2024-02-02, meaning any still-vulnerable deployment is significantly overdue.

How an attack unfolds

An attacker identifies an internet-facing Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti Neurons for ZTA appliance and sends crafted unauthenticated requests to the SAML service. The vulnerable SAML component processes attacker-controlled input and causes the appliance to make requests to restricted local or internal resources on the attacker’s behalf. The attacker uses the returned responses to access information or functionality that should require authentication. In observed campaigns against Ivanti appliances, this class of access has been used alongside other Ivanti vulnerabilities and post-exploitation tradecraft to enumerate the appliance, harvest credentials or session data, deploy web shells or modified appliance scripts, and maintain access for espionage or ransomware-enabled intrusion activity.

How to fix it

Apply the vendor-provided Ivanti fixes or mitigations for the affected product line immediately. Because fixed version details were not provided in the input, administrators should consult the current Ivanti security advisory for CVE-2024-21893 and upgrade Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA to the latest supported fixed release for their branch. If immediate upgrade is not possible, apply Ivanti’s official mitigation XML or workaround for the relevant product, restrict management and SAML exposure to trusted networks where feasible, and monitor closely for exploitation. For any appliance exposed while vulnerable, do not rely on patching alone: run Ivanti’s external and internal integrity checking tools, preserve logs before remediation, rotate administrative credentials, revoke or rotate certificates and secrets where compromise is suspected, invalidate active sessions, and consider rebuilding or factory-resetting appliances if compromise indicators are present.

How to confirm the fix worked

Confirm the appliance reports a fixed software version or that Ivanti’s official mitigation for CVE-2024-21893 is successfully applied. Verify that the SAML endpoint is no longer vulnerable using a safe, authorized vulnerability scanner or vendor-recommended validation procedure rather than public exploit code. Run Ivanti’s integrity checker and confirm there are no unexpected modified files, web shells, or failed integrity checks. Review external exposure to ensure only required services are internet-accessible and management interfaces are restricted. Confirm that logs show no continued unauthenticated probing of SAML endpoints after remediation and that security monitoring is alerting on suspicious requests to Ivanti SAML and API paths.

Typical attack path

1. Scan the internet or target range for Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti Neurons for ZTA appliances.
2. Confirm the SAML service is reachable from the network without authentication.
3. Send crafted SAML-related requests that cause the appliance to perform server-side requests to restricted local or internal resources.
4. Use exposed responses to retrieve sensitive configuration, appliance state, or internal API output.
5. Chain the SSRF with other vulnerabilities, stolen credentials, or appliance misconfigurations to gain deeper control.
6. Establish persistence by modifying appliance files, deploying web shells, or creating access paths that survive normal authentication controls.
7. Use the compromised edge appliance for internal reconnaissance, credential theft, lateral movement, data theft, or ransomware staging.

How to detect it

Review appliance web access logs, event logs, system logs, reverse proxy logs, WAF logs, EDR telemetry if available on supporting infrastructure, and network traffic captures for suspicious unauthenticated access to Ivanti SAML endpoints, especially requests to /dana-ws/saml20.ws. Look for crafted SAML payloads that reference localhost, loopback addresses, link-local addresses, RFC1918 internal IP ranges, or internal URLs, as these are consistent with SSRF attempts. Hunt for unusual requests that combine SAML processing with access to local API paths, unexpected 200 responses to unauthenticated requests, high-volume probing, or requests from hosting providers, VPNs, Tor exit nodes, and scanners. Because this vulnerability has been exploited in campaigns against Ivanti edge appliances, also look for post-exploitation signs: modified appliance files, unexpected Perl modules or CGI files, web shells, new or altered scheduled tasks, suspicious outbound connections from the appliance, credential dumping activity, anomalous administrator logins, and abnormal VPN/ZTA session creation. Compare appliance file integrity against vendor baselines and investigate any integrity checker failures. If ransomware activity is a concern, correlate Ivanti exploitation telemetry with later internal authentication anomalies, lateral movement, remote management tool execution, large data transfers, and encryption tooling.

• /dana-ws/saml20.ws
• POST /dana-ws/saml20.ws
• GET /dana-ws/saml20.ws
• SAMLRequest=
• SAMLResponse=
• 127.0.0.1
• localhost
• 169.254.169.254
• http://127.0.0.1
• https://127.0.0.1
• http://localhost
• https://localhost
• /api/v1/
• /api/v1/totp/user-backup-code
• /api/v1/system/system-information
• /home/perl/DSLogConfig.pm
• /home/etc/sql/dsserver/sessionserver.pl
• /dana/html5acc/guacamole/
• /dana-na/auth/saml-sso.cgi
• LIGHTWIRE
• WIREFIRE
• WARPWIRE
• ZIPLINE
• THINCRUST

What your security team should do

• Treat any internet-facing affected Ivanti appliance that was unpatched after public disclosure as potentially compromised, not merely vulnerable.
• Patch or apply Ivanti’s official mitigation immediately; this issue is in CISA KEV, actively exploited, has near-certain EPSS likelihood, and is associated with ransomware activity.
• Run Ivanti’s integrity checking tools and preserve appliance logs, configuration backups, and forensic artifacts before making destructive changes.
• Hunt for unauthenticated requests to SAML endpoints, suspicious localhost or internal-resource references in request payloads, unexpected API access, and modified appliance scripts or web-accessible files.
• Rotate administrative passwords, service credentials, API keys, SAML secrets, and certificates if exploitation or appliance tampering is suspected.
• Invalidate active VPN/ZTA sessions and review recent account activity for impossible travel, unusual source networks, and new or abnormal remote access patterns.
• If compromise indicators are confirmed, rebuild or factory-reset the appliance following vendor guidance rather than assuming an in-place patch fully removes attacker persistence.
• Add SIEM detections for Ivanti SAML exploitation attempts and known post-exploitation artifacts, and prioritize investigation of alerts involving edge appliances.