CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Description
CVE-2024-21887 is a CRITICAL command injection vulnerability in the web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x), carrying a CVSS 3.1 score of 9.1. The flaw, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), allows an authenticated administrator to send specially crafted HTTP requests that execute arbitrary operating system commands on the underlying appliance. Although exploitation requires administrative privileges, when chained with the companion authentication bypass vulnerability CVE-2023-46805, the attack becomes fully unauthenticated and results in remote code execution. This CVE is listed in CISA’s Known Exploited Vulnerabilities catalog, has been confirmed exploited by both ransomware groups and nation-state threat actors, and had a remediation deadline of January 22, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 9.0; 9.1; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6 |
| ivanti | policy secure | 9.0; 9.1; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command
CVE-2024-21887 is classified under CWE-77 — Improper Neutralization of Special Elements used in a Command. This weakness occurs when user-controlled input is incorporated into system commands without adequate sanitization or escaping. The Ivanti web component constructs operating system commands using attacker-supplied data, allowing injected shell metacharacters or command separators to alter the intended command sequence and execute arbitrary code.
Command injection vulnerabilities in network appliances and VPN gateways are especially severe because these systems often run with elevated operating system privileges and occupy a trusted position in the network architecture. Successful exploitation grants the attacker the ability to execute commands at the OS level, install persistent backdoors, exfiltrate data, and pivot to internal network resources.
Impact Analysis
CVE-2024-21887 carries a CVSS 3.1 score of 9.1 (CRITICAL) with Changed Scope and High impact across all three dimensions.
Confidentiality (High): Arbitrary command execution on the appliance gives an attacker full access to all data accessible by the process, including VPN session data, configuration files containing network credentials, private keys, and data from internal network resources the gateway can reach. In observed real-world attacks, threat actors exfiltrated credentials and sensitive configuration data.
Integrity (High): Attackers can modify system files, install webshells and persistent backdoors, alter VPN routing rules, or deploy malware. Multiple threat actors have been documented installing custom malware implants on compromised Ivanti appliances that survived factory resets.
Availability (High): Complete control over the appliance allows an attacker to disrupt VPN services, crash the system, or render the device inoperable. Ransomware operators exploiting this CVE have caused widespread operational disruption.
Scope Changed: The Scope is marked Changed (C), meaning the vulnerable component can affect resources beyond its own security scope. Code execution on the VPN gateway provides a foothold for attacking the internal corporate network it protects.
With an EPSS score of 0.944 (99.97th percentile), this vulnerability has near-certain exploitation activity in the wild.
Exploit Maturity
CVE-2024-21887 has an extremely high exploit maturity, with active exploitation confirmed at the time of disclosure.
Zero-day exploitation: This vulnerability was exploited in the wild as a zero-day before patches were publicly available. Initial exploitation was attributed to sophisticated threat actors, potentially including nation-state-affiliated groups.
Ransomware association: CISA’s KEV catalog confirms ransomware association for CVE-2024-21887. The vulnerability has been leveraged by ransomware operators as part of initial access and lateral movement campaigns.
Combined exploit chain: CVE-2024-21887 is most impactful when combined with CVE-2023-46805 (authentication bypass). This chain allows a fully unauthenticated remote attacker to achieve arbitrary command execution on affected Ivanti appliances. Public exploit code for the combined chain has been released, significantly lowering the bar for exploitation.
Widespread impact: Thousands of Ivanti gateway appliances were compromised in campaigns exploiting this vulnerability chain. Multiple threat intelligence organizations documented mass exploitation across diverse industries and geographies.
Persistent implants: Some threat actors deployed custom malware that persisted across Ivanti’s standard patch and upgrade processes, requiring factory resets to remediate.
Remediation
- Apply Ivanti security patches immediately. Follow the official Ivanti security advisory for Connect Secure and Policy Secure to apply the available mitigations and patches.
- Perform a factory reset and re-image from a clean baseline. Given confirmed cases of persistent malware surviving standard updates, Ivanti and CISA strongly recommended factory-resetting affected appliances and re-deploying from a clean, known-good image rather than patching in place.
- Run the Ivanti Integrity Checker Tool (ICT) before and after remediation. Use the ICT to detect unauthorized file modifications, webshells, and persistent implants on the appliance. A clean ICT scan does not guarantee absence of compromise — perform factory reset regardless if active exploitation is suspected.
- Rotate all credentials and certificates. Treat all credentials, private keys, VPN certificates, and passwords stored on or accessible through the affected Ivanti appliance as compromised. Revoke and reissue all affected credentials across the organization.
- Audit internal network for signs of lateral movement. Ivanti gateways are trusted network perimeter devices. Investigate internal systems for compromise originating from the gateway, unexpected new accounts, lateral movement, or data exfiltration.
- Discontinue use if remediation is not feasible. Per CISA KEV requirements, discontinue use of the product if mitigations cannot be applied within the required timeframe.
Technical Details
CVE-2024-21887 is a command injection vulnerability in the web components of Ivanti Connect Secure and Policy Secure. The affected web interface constructs operating system commands by incorporating attacker-controlled input without proper sanitization, allowing injection of arbitrary shell commands.
Attack vector and prerequisites: The attack requires authenticated administrator access (PR:H), but with an attack vector of Network and no user interaction (AV:N/UI:N). In isolation, this limits exploitation to authenticated administrators. However, when CVE-2023-46805 (authentication bypass) is used first to gain unauthorized admin-level access, the combined chain becomes fully unauthenticated.
Command injection mechanism: The vulnerability in the web component processes specially crafted HTTP requests where malicious content in specific parameters is passed to system-level command execution functions. Injected commands execute in the context of the web server process, which on these appliances typically has significant OS-level privileges.
Scope Changed: The CVSS scope is Changed (C), reflecting that code execution on the Ivanti gateway provides access to the internal networks the appliance is designed to protect — extending the impact well beyond the device itself.
Persistence techniques: Threat actors who exploited this vulnerability installed webshells, modified legitimate binary files, and created backdoor accounts. Some implants were designed to survive firmware upgrades and standard security patches, requiring factory resets as the only reliable remediation.
Frequently Asked Questions
What is CVE-2024-21887?
CVE-2024-21887 is a critical command injection vulnerability in the web components of Ivanti Connect Secure and Ivanti Policy Secure. It allows an authenticated administrator to execute arbitrary operating system commands by sending specially crafted HTTP requests. When chained with authentication bypass CVE-2023-46805, it enables fully unauthenticated remote code execution.
Which products are affected by CVE-2024-21887?
Affected products are Ivanti Connect Secure versions 9.x and 22.x, and Ivanti Policy Secure versions 9.x and 22.x. Organizations using these Ivanti VPN and network access control products without the applicable security patches are at risk. The vulnerability exists in the web-facing administrative components of these gateway appliances.
How do I fix CVE-2024-21887?
Apply patches per the Ivanti security advisory. Due to confirmed active exploitation and persistent implants that can survive standard updates, Ivanti and CISA recommend performing a factory reset and re-imaging affected appliances. Run the Ivanti Integrity Checker Tool to assess compromise, and rotate all credentials accessible through the gateway. Monitor internal networks for signs of lateral movement.
How severe is CVE-2024-21887?
CVE-2024-21887 is rated CRITICAL with a CVSS 3.1 score of 9.1. Its EPSS score of 0.944 places it in the 99.97th percentile for exploitation likelihood. CISA confirmed active exploitation and ransomware association with a federal remediation deadline of January 22, 2024. When combined with CVE-2023-46805, it forms a fully unauthenticated remote code execution chain affecting Ivanti gateway appliances.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.