CVE-2024-8190

What it actually does

CVE-2024-8190 is an authenticated OS command injection vulnerability in Ivanti Cloud Services Appliance 4.6 Patch 518 and earlier. An attacker with administrator-level access to the appliance can inject operating system commands through vulnerable appliance functionality and cause those commands to execute on the underlying host. Successful exploitation provides remote code execution in the security context of the appliance web/application process and can be used to install web shells, create persistence, modify appliance configuration, collect credentials or tokens, and pivot into connected management networks. Although the flaw requires admin privileges by itself, it has been actively exploited in the wild and has been observed in vulnerability chains affecting Ivanti Cloud Services Appliance deployments.

Why it matters to the business

Compromise of an Ivanti Cloud Services Appliance can give an attacker control over a trusted remote access and management component, creating risk of credential theft, unauthorized access to managed systems, service disruption, and broader network compromise. The vulnerability is listed in CISA KEV, has a high EPSS score of 0.89122, and has active in-the-wild exploitation; the CISA remediation deadline was 2024-10-04, so unremediated appliances should be treated as high-priority exposure. No ransomware-specific KEV flag is present, but exploitation of edge appliances is commonly used for initial access and persistence.

How an attack unfolds

An attacker first obtains administrator-level access to the Ivanti Cloud Services Appliance or chains another vulnerability to reach privileged appliance functionality without legitimate credentials. The attacker then sends a crafted request to the vulnerable appliance function containing shell metacharacters or command payloads. The appliance fails to safely separate user-controlled input from OS command execution, causing the injected command to run on the underlying system. After confirming command execution, the attacker typically runs discovery commands, stages tooling with curl or wget, writes a web shell or backdoor, modifies accounts or scheduled jobs for persistence, and attempts to harvest credentials or pivot to systems reachable from the appliance. Public reporting indicates active exploitation against Ivanti Cloud Services Appliance vulnerabilities, including chaining activity, so investigations should not assume exploitation required a valid administrator login only.

How to fix it

Upgrade affected Ivanti Cloud Services Appliance deployments immediately. Appliances running CSA 4.6 Patch 518 or earlier should be updated to the vendor-fixed release, commonly referenced as CSA 4.6 Patch 519 or later, or migrated to a supported fixed 5.x release where applicable. Follow Ivanti’s official advisory and upgrade path for the exact appliance version in use. Because this vulnerability is actively exploited and listed in CISA KEV, patching alone may not be sufficient for exposed systems: perform compromise assessment before returning the appliance to service. If immediate upgrade is not possible, restrict appliance access to trusted administrative networks, block internet exposure, enforce strong MFA for administrative access, review and rotate administrator credentials, and monitor for command execution and file-write activity. Consider rebuilding or replacing any appliance with credible evidence of compromise.

How to confirm the fix worked

Confirm the appliance version and patch level from the administrative interface, CLI, or vendor-supported inventory method and verify it is newer than CSA 4.6 Patch 518 or otherwise listed by Ivanti as fixed. Validate that the vulnerable endpoint or function no longer accepts command injection payloads in a controlled, authorized test environment. Confirm that administrative access is restricted to approved networks and that no unexpected administrator accounts, scheduled jobs, startup scripts, web files, or outbound connections exist. Review post-upgrade logs to ensure no continued exploitation attempts are succeeding. For previously exposed appliances, complete forensic review or rebuild validation before treating the device as trusted.

Typical attack path

1. Identify an internet-accessible or reachable Ivanti Cloud Services Appliance running version 4.6 Patch 518 or earlier.
2. Authenticate with administrator privileges or use a separate vulnerability chain to access privileged appliance functionality.
3. Send a crafted request to the vulnerable command-executing function with injected shell syntax.
4. Execute reconnaissance commands such as id, whoami, uname, hostname, ip/ifconfig, netstat, or ps to validate access.
5. Stage additional payloads using curl, wget, certutil-like transfer equivalents, or direct file writes.
6. Create persistence through web shells, modified appliance files, new users, cron jobs, startup scripts, or reverse shell callbacks.
7. Collect credentials, configuration data, session material, or appliance secrets.
8. Use the compromised appliance as a trusted foothold for lateral movement or further exploitation.

How to detect it

Investigate appliance web access logs, administrative audit logs, authentication logs, system logs, process execution telemetry, file integrity monitoring, EDR data, network proxy logs, DNS logs, and firewall egress logs. Look for administrative requests to Ivanti CSA endpoints that include shell metacharacters such as semicolons, pipes, backticks, dollar-parentheses, URL-encoded command separators, or common post-exploitation commands. Pay special attention to activity against DateTime or appliance configuration pages, especially from unusual source IPs, after-hours sessions, or sessions followed by process creation on the appliance. Hunt for web server or PHP-related processes spawning /bin/sh, bash, curl, wget, nc, python, perl, chmod, chattr, tar, or base64. Review the filesystem for newly created or recently modified PHP, shell script, ELF, or archive files under appliance web roots, temporary directories, and persistence locations. Check for unexpected outbound HTTP, HTTPS, DNS, or reverse-shell traffic from the appliance to unfamiliar infrastructure. Because exploitation has been observed in chains, also review for anomalous requests that indicate path traversal, authentication bypass, or access to privileged resources without a normal administrator login sequence.

• /gsb/DateTimeTab.php
• POST /gsb/DateTimeTab.php
• TIMEZONE=
• %3Bcurl
• %3Bwget
• %7Ccurl
• %7Cwget
• %60id%60
• $(id)
• ;id
• ;whoami
• ;uname -a
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http
• nc -e
• /tmp/
• /var/tmp/
• httpd spawned /bin/sh
• httpd spawned bash
• httpd spawned curl
• httpd spawned wget
• php spawned /bin/sh
• php spawned bash
• php spawned curl
• php spawned wget

What your security team should do

• Treat unpatched Ivanti Cloud Services Appliance 4.6 Patch 518 and earlier as urgent due to active exploitation, high EPSS, and CISA KEV status.
• Patch or migrate affected appliances immediately; the KEV due date of 2024-10-04 has passed.
• If the appliance was internet-facing or reachable by untrusted networks, perform compromise assessment before and after patching.
• Search logs for requests to vulnerable appliance administrative paths containing shell metacharacters, command strings, or payload download attempts.
• Review administrator accounts, recent logins, configuration changes, scheduled tasks, cron entries, and modified web/application files.
• Hunt for appliance processes spawning shells, curl, wget, nc, python, perl, or other unusual child processes.
• Rotate appliance administrator credentials, API tokens, and any credentials stored on or proxied through the appliance if compromise is suspected.
• Restrict management access to trusted networks and require MFA for administrative access.
• Monitor for chaining activity involving other Ivanti Cloud Services Appliance vulnerabilities, especially authentication bypass or path traversal used to reach privileged functionality.
• Escalate suspected exploitation to incident response and consider appliance rebuild from trusted media if web shells, persistence, or unknown file modifications are found.