Ivanti Connect Secure Web Component Command Injection
Command injection vulnerability in web components of Ivanti Connect Secure allowing authenticated administrators or chained unauthenticated actors to send crafted requests and execute arbitrary commands.
- Status
- Vendor Patched
- Reported / Disclosed
- 2024
Impact
- Chaining with authentication bypass (CVE-2023-46805) allowed unauthenticated full appliance takeover.
- Execution of arbitrary Python payload stagers directly from web parameters.
- Compromise of internal VPN authentication credentials and Active Directory domain secrets.
Timeline
JANUARY 10, 2024
Initial advisory and temporary XML mitigation issued by Ivanti.
JANUARY 31, 2024
Comprehensive firmware security update released for impacted gateway builds.
FEBRUARY 2024
Incident response playbooks and IOC signatures integrated into security operations.
aura~