CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2024-21893 is a server-side request forgery (SSRF) vulnerability affecting the SAML component of Ivanti Connect Secure (versions 9.x and 22.x), Ivanti Policy Secure (versions 9.x and 22.x), and Ivanti Neurons for ZTA. An unauthenticated remote attacker can exploit this vulnerability to access certain restricted internal resources without valid credentials by sending crafted SAML requests that cause the server to make unauthorized requests on the attacker's behalf. CISA has confirmed active exploitation of CVE-2024-21893 in the wild and has added it to the Known Exploited Vulnerabilities catalog, with ransomware campaigns observed leveraging this flaw. With an EPSS score of 94.3%, this vulnerability represents a near-certain exploitation risk and requires immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 9.0; 9.1; 21.9; 21.12; 22.1; 22.2; 22.3; 22.4; 22.6 |
| ivanti | policy secure | 9.0; 9.1; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6 |
| ivanti | neurons for zero-trust access | -; 22.2; 22.3; 22.4; 22.5; 22.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2024-21893 is classified as a Server-Side Request Forgery (SSRF) vulnerability, where the affected server — in this case the SAML authentication component of Ivanti products — can be manipulated into making HTTP or other protocol requests to arbitrary internal or restricted resources on behalf of an attacker. In the Ivanti Connect Secure and Policy Secure context, this allows an unauthenticated attacker to bypass authentication controls and reach internal services or administrative endpoints that should not be publicly accessible.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2024-21893 carries a CVSS 3.1 score of 8.2 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. Attack Vector (Network): this vulnerability is remotely exploitable without any physical access to the target infrastructure. Attack Complexity (Low): exploitation requires no special conditions or complex setup, making it accessible to a wide range of threat actors. Privileges Required (None) and User Interaction (None): an attacker needs no authentication and no victim interaction — they can directly target exposed Ivanti endpoints. Confidentiality (High): successful exploitation grants access to restricted internal resources and sensitive data that should be protected behind authentication. Integrity (Low): limited modification of accessible resources is possible. With an EPSS score of 94.3% — placing this CVE in the 99.9th percentile — active exploitation is near-certain, and confirmed ransomware usage makes this an immediate threat to organizations running affected Ivanti products.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2024-21893 in the wild, adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2024-02-02. Ransomware operators have been observed leveraging this vulnerability, making it a critical-priority threat. No references tagged as public exploit code or PoC are listed in the provided references, though the EPSS score of 94.3% — in the 99.9th percentile — indicates near-certain exploitation activity across the threat landscape. Organizations running Ivanti Connect Secure, Policy Secure, or Neurons for ZTA should treat active exploitation as confirmed and act immediately.
Remediation
- Apply vendor mitigations immediately: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Upgrade to a patched release: Upgrade Ivanti Connect Secure and Ivanti Policy Secure to versions that address CVE-2024-21893 as published by Ivanti in their security advisories. Follow the guidance at the Ivanti support portal for version-specific patch instructions.
- Restrict external exposure of SAML endpoints: Implement network-level controls (firewall rules, web application firewall policies) to limit access to SAML authentication components to trusted IP ranges only, reducing the attack surface while patching is underway.
- Audit server-side request destinations: Review logs for anomalous outbound connections initiated by the Ivanti server — signs of SSRF exploitation include unexpected requests to internal IP ranges or non-standard ports.
- Check for indicators of compromise: Given confirmed ransomware usage, conduct a thorough review of access logs, credential stores, and connected systems for signs of lateral movement or data exfiltration that may have occurred prior to patching.
Technical Details
CVE-2024-21893 is a Server-Side Request Forgery (SSRF) flaw in the SAML authentication component of Ivanti Connect Secure, Policy Secure, and Neurons for ZTA. SSRF vulnerabilities arise when an application parses user-supplied input to construct and execute server-side requests without sufficient validation, allowing the attacker to redirect those requests to internal or restricted network resources. In this case, a maliciously crafted SAML message causes the Ivanti server to initiate unauthorized requests to restricted resources, effectively using the server as a proxy to bypass perimeter controls and access internal services. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms the vulnerability is network-exploitable, requires no authentication, and imposes no conditions on the attacker — making it straightforward to target any internet-exposed Ivanti instance. The high confidentiality impact reflects the ability to retrieve sensitive internal data or access protected administrative interfaces.
Frequently Asked Questions
Is CVE-2024-21893 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2024-21893 to its Known Exploited Vulnerabilities catalog with a required remediation deadline of February 2, 2024. Ransomware campaigns have been observed exploiting this vulnerability, and the EPSS score of 94.3% confirms near-certain exploitation activity in the wild.
What products are affected by CVE-2024-21893?
CVE-2024-21893 affects Ivanti Connect Secure (versions 9.x and 22.x), Ivanti Policy Secure (versions 9.x and 22.x), and Ivanti Neurons for Zero-Trust Access (ZTA). Organizations running any of these products should check their installed versions against Ivanti's security advisories.
How do I fix CVE-2024-21893?
Apply the vendor-supplied patches from Ivanti immediately, following the guidance in Ivanti's security advisory. As an interim measure, restrict network access to SAML authentication endpoints and review logs for signs of exploitation. CISA requires federal agencies to have remediated this vulnerability by February 2, 2024.
How severe is CVE-2024-21893?
CVE-2024-21893 is rated HIGH with a CVSS 3.1 score of 8.2, reflecting unauthenticated remote exploitability and high confidentiality impact. Its EPSS score of 94.3% (99.9th percentile) and confirmed ransomware usage make this one of the most actively exploited vulnerabilities in the Ivanti product line.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.