Ivanti Connect Secure RCE via CVE-2024-21887 — Mitigation Guide

Recent telemetry from the Internet Storm Center indicates that scanning activity for edge infrastructure remains high, particularly targeting aging vulnerabilities in remote access solutions. According to SANS ISC, attackers are maintaining a persistent interest in identifying unpatched Ivanti Connect Secure (formerly Pulse Secure) and Ivanti Policy Secure gateways. This scanning often precedes the deployment of specialized exploits that chain together multiple CVE entries to achieve unauthorized access and RCE.

Technical Analysis of the Exploit Chain

The primary threat involves the exploitation of CVE-2023-46805 and CVE-2024-21887. The first vulnerability, CVE-2023-46805, is an authentication bypass located in the web server component of the appliance. By crafting specific requests to vulnerable API endpoints, such as those associated with the /api/v1/configuration/ path, an attacker can circumvent security controls without valid credentials. This vulnerability carries a CVSS score of 8.2.

Once authentication is bypassed, the attacker leverages CVE-2024-21887, a command injection vulnerability. While this flaw technically requires administrative privileges, the previous bypass provides the necessary context to execute arbitrary commands. By combining these two, threat actors can gain system-level access to the gateway, enabling them to steal session cookies, modify configurations, and establish C2 communication channels. Because these devices reside at the network edge and often lack traditional EDR agents, they are high-value targets for Lateral Movement.

Tracking 1-Day Vulnerability Scanning in Edge Infrastructure

Data suggests that tracking 1-day vulnerability scanning is essential for modern SOC teams. Attackers frequently automate the discovery of these flaws using publicly available proof-of-concept (PoC) code. In the case of Ivanti, the exploits target specific Python-based components of the appliance’s underlying OS.

Observing the TTP of these campaigns shows a focus on environmental persistence. Attackers often attempt to modify the Ivanti Integrity Checker Tool (ICT) or alter system files to ensure that their presence survives a reboot or a basic integrity scan. This advanced post-exploitation behavior aligns with MITRE ATT&CK techniques for subverting security software.

How to Detect CVE-2023-46805 Exploit Attempts

To identify potential compromise, defenders should analyze web server logs for unusual requests to the /api/v1/ directory, specifically those originating from unexpected geographical locations or known malicious IPs. An IoC commonly associated with these scans is the presence of requests targeting the license/keys-status or rest-userrole1 endpoints.

Defenders must also implement Zero Trust principles by segmenting edge devices from the core internal network. This limits the blast radius if the gateway is compromised.

Recommended Mitigation Strategies

The most effective Ivanti Connect Secure RCE mitigation is the immediate application of the latest firmware patches provided by the vendor. For organizations unable to patch immediately, Ivanti has provided an XML mitigation file that disables the vulnerable API endpoints.

1. Run the External Integrity Checker: Use the latest version of the Ivanti ICT to scan for file system modifications.
2. Review Configuration Logs: Look for the creation of new administrative accounts or changes to VPN user roles.
3. Monitor Outbound Traffic: Check for anomalous connections from the appliance to external IP addresses that may indicate data exfiltration or reverse shell activity.