This vulnerability only affects a limited number of supported versions-Ivanti Connect Secure, Ivanti Policy Secure version 22.5R1.1 and ZTA version 22.6R1.3.
Please read between the lines that there could be unsupported versions which will never see a patch for this vulnerability.
A patch is available now for Ivanti Connect Secure, Ivanti Policy Secure and ZTA gateways.
Customers can access the patch via the standard download portal.
Due to all the different versions that are available, it is imperative to carefully read the instructions.
Customers can read this KB article for detailed instructions on how to apply the mitigation and apply the patch as each version becomes available.
Please ensure you are following the KB article to receive updates.
Customers who applied the patch released on January 31 or February 1, and completed a factory reset of their appliance, do not need to factory reset their appliances again.
Once customers applied this newly released patch, they do not need to apply the mitigation or the patches released on January 31 and February 1.
The vulnerability, listed as CVE-2024-22024 with a CVSS score of 8.3 out of 10, allows an attacker to access certain restricted resources without authentication.
An XML external entity injection is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data.
It often allows an attacker to view files on the application server filesystem, and/or to interact with any back-end or external systems that the application itself can access.
Ivanti found the XXE vulnerability in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure and ZTA gateways.
Since Ivanti claims that the vulnerability came up during internal code reviews, it is unlikely that an exploit already exists, but this type of vulnerability is usually easy to exploit, so chances are, this will not take long.
According to Ivanti they are unaware of any evidence of customers being exploited by CVE-2024-22024.
Only a week ago all, FCEB agencies received intructions to disconnect vulnerable Ivanti products before the weekend.
This because besides the Ivanti vulnerabilities actively exploited in massive numbers we wrote about on January 11, 2024, alerts went off about two new high severity flaws on January 31, 2024.
All in all, since January 10, five vulnerabilities have been reported in Ivanti products.
Cybersecurity risks should never spread beyond a headline.
Keep vulnerabilities in tow by using ThreatDown Vulnerability and Patch Management.
This Cyber News was published on www.malwarebytes.com. Publication date: Fri, 09 Feb 2024 18:43:07 +0000