CVE-2024-9380
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Description
CVE-2024-9380 is a high-severity OS command injection vulnerability in the admin web console of Ivanti Cloud Services Appliance (CSA) that allows a remote authenticated attacker with admin privileges to achieve remote code execution. The flaw affects Ivanti Endpoint Manager Cloud Services Appliance versions prior to 5.0.2. With a CVSS v3.1 base score of 7.2 (HIGH), the vulnerability requires high privileges but no user interaction, and has been actively exploited in the wild. CISA added CVE-2024-9380 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 30, 2024, and its EPSS score of 88.14% at the 99.5th percentile indicates extensive exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager cloud services appliance | < 5.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CVE-2024-9380 exploits an OS command injection weakness in Ivanti CSA's admin web console where user-supplied input is incorporated into operating system commands without proper sanitization. This allows an authenticated administrator to inject arbitrary OS commands that are executed with the privileges of the web application process. OS command injection is one of the most dangerous vulnerability classes because it provides direct access to the underlying operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
The impact of CVE-2024-9380 spans all three security pillars, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised. The attack is network-accessible (AV:N) with low complexity (AC:L), but requires high privileges (PR:H) corresponding to admin-level access to the CSA web console. While the admin privilege requirement limits the initial attack surface, compromised admin credentials or chaining with other vulnerabilities such as CVE-2024-8963 (admin bypass) can provide the required access level. The Ivanti Cloud Services Appliance serves as a critical gateway for managing enterprise endpoints, and its compromise gives attackers a strategic position from which to deploy malicious configurations, intercept management traffic, and pivot into the managed endpoint infrastructure. The EPSS score of 88.14% at the 99.5th percentile reflects the fact that CVE-2024-9380 has been observed chained with other Ivanti CSA vulnerabilities (CVE-2024-8963 and CVE-2024-9381) in sophisticated attack campaigns that bypass the authentication requirement. While the ransomware nexus is listed as Unknown, the appliance's privileged network position makes compromise particularly dangerous.
Exploit Maturity
CVE-2024-9380 has advanced exploit maturity with confirmed active exploitation in chained attack campaigns. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 30, 2024. The EPSS score of 88.14% at the 99.5th percentile indicates widespread exploitation activity. Ivanti published a security advisory covering this vulnerability alongside related CSA flaws at Ivanti Security Advisory. The vulnerability has been observed exploited in combination with CVE-2024-8963 (path traversal to admin access) and CVE-2024-9381 (another CSA vulnerability), forming a complete attack chain from unauthenticated access to remote code execution. Threat actors have been targeting Ivanti CSA appliances as part of a broader campaign against Ivanti products, leveraging the management appliance's privileged position to compromise entire endpoint fleets.
Remediation
-
Upgrade Ivanti Cloud Services Appliance to version 5.0.2 or later immediately as documented in the Ivanti security advisory. This update patches CVE-2024-9380 along with related vulnerabilities CVE-2024-9379 and CVE-2024-9381.
-
Restrict admin console access to the CSA by implementing strict IP-based access controls that limit web console access to authorized management workstations only. Disable any direct internet exposure of the CSA admin interface.
-
Audit CSA admin accounts and access logs for unauthorized access or suspicious activity. Review admin account creation, password changes, and command execution logs. Check for indicators that the vulnerability has been chained with CVE-2024-8963 to bypass authentication.
-
Perform a forensic review of the CSA appliance to check for web shells, unauthorized files, modified configurations, or backdoor accounts. If compromise is suspected, rebuild the CSA appliance from a known-good image rather than attempting to clean a potentially compromised system.
-
Implement multi-factor authentication (MFA) for CSA admin access to reduce the risk of credential-based attacks and make it harder for attackers to chain authentication bypass vulnerabilities with command injection. Monitor for future Ivanti security advisories and establish a rapid patching process for management appliances.
Technical Details
CVE-2024-9380 is an OS command injection vulnerability in the Ivanti Cloud Services Appliance admin web console. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring high privileges (PR:H) and no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact across confidentiality, integrity, and availability. The high privilege requirement (PR:H) maps to admin-level access on the CSA web console, which in practice can be obtained through credential theft, brute force, or chaining with CVE-2024-8963 (an admin authentication bypass). The vulnerability exists in a web console feature that passes admin-supplied input to operating system commands without proper sanitization or parameterization. An authenticated admin can inject shell metacharacters (such as semicolons, pipes, or backticks) into input fields that are incorporated into system commands, causing the injected commands to execute with the privileges of the CSA web application process. This typically provides root or administrator-level access to the appliance operating system. The attack has been observed in the wild chained with CVE-2024-8963 for authentication bypass and CVE-2024-9381 for additional capabilities, forming a complete exploitation chain against the Ivanti CSA platform.
Frequently Asked Questions
Is CVE-2024-9380 being actively exploited?
Yes, CISA confirmed active exploitation and added CVE-2024-9380 to the Known Exploited Vulnerabilities catalog. The vulnerability has been observed in chained attacks with CVE-2024-8963 and CVE-2024-9381, and its EPSS score of 88.14% at the 99.5th percentile reflects widespread exploitation.
What products are affected by CVE-2024-9380?
Ivanti Endpoint Manager Cloud Services Appliance (CSA) versions before 5.0.2 are affected. This includes all CSA deployments that have not been updated to the patched version.
How do I fix CVE-2024-9380?
Upgrade the Ivanti CSA to version 5.0.2 or later. Restrict admin console access to authorized IP addresses, implement MFA for admin accounts, and audit the appliance for indicators of compromise.
Can CVE-2024-9380 be exploited without admin credentials?
The vulnerability itself requires admin-level authentication. However, attackers have been observed chaining CVE-2024-9380 with CVE-2024-8963, an authentication bypass vulnerability, to achieve unauthenticated remote code execution. This makes patching critical even if admin credentials are considered secure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.