On Jan. 10, 2024, Ivanti disclosed two new vulnerabilities in their Ivanti Connect Secure and Ivanti Policy Secure gateways: CVE-2023-46805 and CVE-2024-21887.
The first CVE is a High severity authentication bypass vulnerability, and the second CVE is a Critical severity command injection vulnerability.
These vulnerabilities impact all supported versions of the gateways.
We are sharing our observations of device exposure and possible related threat activity to aid in developing security measures as threat actors are actively exploiting these vulnerabilities.
Use of these two Ivanti products is widespread. Unit 42 observed 30,089 exposed instances of Connect Secure in 141 countries as of Jan. 9, 2024.
Ivanti plans to begin releasing patches addressing these vulnerabilities the week of Jan. 22, 2024.
Until patches are available, Ivanti has provided a workaround.
We assess with moderate to high confidence that threat actors, likely at the nation-state level, will continue to target and exploit devices impacted by these vulnerabilities as initial access vectors into target environments for espionage purposes.
Ivanti also recommends customers perform a workaround until patches are made available.
The first vulnerability is an authentication bypass vulnerability in the web component of all supported versions of Ivanti Connect Secure and Ivanti Policy Secure.
The second vulnerability is a command injection vulnerability in the web components of Ivanti Connect Secure and Ivanti Policy Secure.
According to Ivanti, their products are used by over 40,000 companies around the world.
Unit 42 is engaged in incident response cases that are suspected to be related to exploitation of these vulnerabilities.
Ivanti has provided a workaround to be applied until they release patches.
They have stated that they have seen evidence of attackers attempting to manipulate Ivanti's internal integrity checker.
They are recommending that all customers run Ivanti's external integrity checker, which has been updated with additional functionality to address this issue.
As there is no patch currently available, it's important to follow the mitigation steps Ivanti recommends as the two new vulnerabilities are actively being exploited.
Prisma Cloud monitors Ivanti Cloud Secure products, which are not known to be vulnerable to either of these vulnerabilities at this time.
Prisma Cloud's security research team will continue to monitor the situation and update Prisma Cloud detections should Ivanti Cloud Connect be found vulnerable to these threats.
Insecure detections of Ivanti Connect Secure are default enabled for all customers.
This Cyber News was published on unit42.paloaltonetworks.com. Publication date: Wed, 17 Jan 2024 00:13:04 +0000