Two zero-day vulnerabilities in Ivanti Connect Secure VPN devices are under active exploitation by unknown attackers, Volexity researchers have discovered.
Patches for these flaws are currently unavailable, but the risk of exploitation can be mitigated by importing mitigation.
1.xml file via Ivanti's download portal.
The two security flaws affect all supported versions of Ivanti Connect Secure - formerly known as Pulse Connect Secure - and Ivanti Policy Secure.
CVE-2023-46805 allows attackers to bypass authentication and CVE-2024-21887 is a command injection vulnerability in the devices' web component that allows authenticated attackers to send specially crafted requests and execute arbitrary commands on the appliance.
By exploiting the former, attackers are able to leverage an exploit for the latter without actually authenticating themselves to the target device.
A subsequent incident response investigation revealed that the attackers got in via the the organization's internet-facing Ivanti Connect Secure appliance, whose logs had been wiped and on which logging had been disabled.
They found evidence of the attackers leveraging two zero-days in tandem.
Security researcher Kevin Beaumont used Shodan to discover the number of potentially vulnerable internet-facing Ivanti devices, and it turns out there are over 15,000.
In the last couple of years, organizations have embraced a hybrid approach to work and VPN devices have become a necessity to allow employees to securely access enterprise assets.
Since these devices are always connected to the internet, exploiting their vulnerabilities - whether zero-days or not - has become a favorite tactic of well-resourced threat actors.
In the meantime, the aforementioned mitigation release should be applied and all customers are advised to run the external ICS Integrity Checker Tool.
Organizations must check whether their systems have been compromised and, if they have, discover the extent of the compromise.
Volexity's post outlines indicators of compromise they can use, as well as advice on remediation.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Thu, 11 Jan 2024 12:13:04 +0000