Skip to content
All posts

· by NetProtector Security Team

Ivanti Connect Secure: Zero-Day Chain Opens VPN Gateways Without Authentication

Illustration: Chained vulnerabilities lead to the VPN gateway's login page, entered passwords flow to an external server

A VPN gateway is supposed to decide who gets into the corporate network. With Ivanti Connect Secure – formerly Pulse Connect Secure – this decision can currently be bypassed entirely: two until recently unknown vulnerabilities, CVE-2023-46805 and CVE-2024-21887, allow attackers to execute commands on the gateway without logging in at all. Ivanti disclosed the vulnerabilities on January 10, 2024, and the US agency CISA added them to its catalog of known exploited vulnerabilities the same day. One week later, there is still no patch – only a workaround.

What it is about

The attacks were discovered by the security company Volexity. In the second week of December 2023, suspicious lateral movement was noticed in a customer's internal network. The trail led to the Ivanti gateway at the internet edge, from which conspicuous activity had been originating since at least December 3, 2023.

The key facts according to Ivanti, Volexity and CISA:

  • Vulnerabilities: CVE-2023-46805 is an authentication bypass in the web component (CVSS 8.2). CVE-2024-21887 is a command injection (CVSS 9.1) which, on its own, requires an administrator login. In combination, this hurdle disappears.
  • Affected: all supported versions 9.x and 22.x of Ivanti Connect Secure and Ivanti Policy Secure.
  • Fixed in: no version yet. Ivanti plans to release patches in stages – the first starting the week of January 22, the last in the week of February 19, 2024. Until then, a mitigation is available as an XML file in the download portal.
  • Prerequisite for the attack: a gateway reachable from the internet. The attacker does not need credentials – which means MFA is irrelevant as well.
  • Consequence: execution of arbitrary commands on the gateway and thus control over access to the internal network.

Why this is urgent

Volexity and Mandiant describe in detail what attackers do with a compromised gateway. They modified a JavaScript file of the login page so that every password entered was sent to an external server – Mandiant calls this tool WARPWIRE. In addition, there were webshells, deleted logs and manipulated exclusion lists of Ivanti's own Integrity Checker Tool. From the gateway, the attackers moved laterally via RDP, SMB and SSH, extracted credentials from the memory of Windows systems and copied the Active Directory database. Volexity considers a Chinese state-sponsored actor likely; Mandiant assumes an espionage campaign.

The gateway thus becomes a collection point for credentials: whoever controls it sees every login in plain text – including the passwords employees subsequently use to log in to other systems.

Targeted individual attacks have since turned into a mass campaign. On January 10, Ivanti still spoke of fewer than ten affected customers. According to Volexity, widespread exploitation began on January 11. In a scan of around 30,000 Ivanti gateways, the company had found more than 1,700 compromised devices by January 14 – ranging from small businesses to government agencies and telecommunications providers to Fortune 500 companies. Important: the mitigation prevents new attacks, but does not remove an attacker who is already on the device.

What you should do now

  1. Apply the mitigation immediately. Do not wait for the patch. Import the XML file provided by Ivanti and install the updates as soon as they become available for your version.
  2. Run the Integrity Checker. Ivanti provides an internal and an external tool for this purpose. According to Volexity, new or modified files reported by the checker are a strong indication of compromise. Caution: the external tool reboots the device and overwrites memory – if compromise is suspected, first preserve memory, disk and logs for forensic analysis.
  3. Store logs off the device. Forward the logs to an external server via syslog, as the attackers have deleted logs on the gateway. According to Volexity, the exploit requests themselves do not appear in the logs – so an unremarkable log is no reason to sound the all-clear.
  4. If compromise is suspected, engage a forensics service provider, as Ivanti recommends. You should consider all credentials stored on the gateway or entered through it as compromised and reset them.
  5. Check the internal network. Look for unusual connections originating from the VPN gateway itself – such as RDP or SMB sessions to servers it normally has nothing to do with.

What this means for protecting firewalls

This case illustrates the fundamental problem of VPN gateways particularly clearly: they have to be openly exposed to the internet, and a vulnerability in them is a direct path into the network. This time there is not even a patch, only an interim solution for weeks. And only one day passed between the first targeted attacks and mass exploitation.

NetProtector is designed for exactly this window of time. The appliance operates inline in front of the firewall and VPN gateway and filters traffic before it reaches the portal:

  • A sensor network that spots attackers early. Honeypots, cloud sensors and partner sensors register which addresses are scanning the internet for vulnerable devices. Sources identified there as attackers are also blocked by NetProtector on your network – before they reach your gateway.
  • Anomalies in your own traffic. Systematic scans, an unusually high number of requests from a single source or access patterns that do not match normal operations are detected and reported.
  • Fewer attackers until the patch arrives. NetProtector neither replaces the mitigation nor the update, and it does not clean up an already compromised device. But it reduces the number of attackers that can reach your gateway at all during the critical phase.
The sensor network
Analysed data
Deep packet inspection (layers 2–7)NetFlow / IPFIXDNS queries & responsesTLS/SSH handshake metadataSyslog & event logs

Where the sensor network's data comes from and how NetProtector is placed in front of the firewall without redesigning the network is explained on the page How NetProtector works.

Our assessment

Ivanti is not alone with this problem: VPN gateways from all vendors are attractive targets because they are openly reachable and lead directly into the network. Against a vulnerability that strikes before any login, even the best MFA is of no help. What matters then is how quickly a mitigation is applied, whether an intrusion is noticed, whether the logs are stored in a secure location – and whether there is a layer in front that does not let known attackers through in the first place.

Sources