Ivanti Connect Secure - Stack-based Buffer Overflow

id: CVE-2025-0282

info:
  name: Ivanti Connect Secure - Stack-based Buffer Overflow
  author: ritikchaddha
  severity: critical
  description: |
    Ivanti Connect Secure < 22.7R2.5, Ivanti Policy Secure < 22.7R1.2, and Ivanti Neurons for ZTA gateways < 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS requests.
  impact: |
    Unauthenticated attackers can exploit a stack-based buffer overflow to execute arbitrary code remotely on Ivanti Connect Secure devices, potentially compromising VPN infrastructure and accessing all connected networks.
  remediation: |
    Upgrade to Ivanti Connect Secure version 22.7R2.5, Ivanti Policy Secure version 22.7R1.2, or Ivanti Neurons for ZTA version 22.7R2.3 or later.
  reference:
    - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
    - https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/
    - https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0282
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cve-id: CVE-2025-0282
    cwe-id: CWE-121,CWE-787
    epss-score: 0.99981
    epss-percentile: 0.99981
  metadata:
    verified: true
    max-request: 3
    vendor: ivanti
    product: connect_secure
    shodan-query: http.title:"ivanti connect secure"
  tags: cve,cve2025,ivanti,rce,buffer-overflow,passive,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
      - "{{BaseURL}}/dana-na/auth/url_6/welcome.cgi"
      - "{{BaseURL}}/dana/home/index.cgi"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Ivanti"
          - "Connect Secure"
          - "Policy Secure"
          - "Neurons for ZTA"
        condition: or

      - type: dsl
        dsl:
          - "compare_versions(vulnerable_version, '< 22.7R2.5')"

    extractors:
      - type: regex
        name: vulnerable_version
        part: body
        group: 1
        regex:
          - '(?i)(22\.[0-6][Rr][0-9]+(?:\.[0-9]+)?)'  # All 22.0-22.6 versions vulnerable
          - '(?i)(22\.7[Rr][0-1](?:\.[0-1])?)'        # Policy Secure < 22.7R1.2
          - '(?i)(22\.7[Rr]2(?:\.[0-4])?)'            # Connect Secure < 22.7R2.5, ZTA < 22.7R2.3

      - type: kval
        kval:
          - version