Ivanti Zero-Days: The Gift That Keeps Giving… to Hackers.
Another week, another critical vulnerability chain actively exploited in the wild. Ivanti Connect Secure and Policy Secure gateways are once again in the crosshairs, proving to be a persistent headache for IT and security teams globally.
We’re talking about a series of vulnerabilities, specifically CVE-2023-46805 (authentication bypass), CVE-2024-21887 (command injection), CVE-2024-21888 (privilege escalation), CVE-2024-21893 (SSRF), and the latest, CVE-2024-22024 (XML external entity injection) [1]. These aren’t theoretical exploits; they’re being chained together by various threat actors, including state-sponsored groups like ‘UNC5221’ (believed to be China-linked), to deploy web shells, create backdoor accounts, and establish persistent access [2]. Essentially, if you haven’t patched immediately and then re-evaluated your entire environment, you’re likely compromised.
So What?
This isn’t just a “patch and forget” situation. The sophistication and persistence of these attacks mean that even after applying Ivanti’s patches, organizations are finding new backdoors and compromised credentials [3]. For developers and security teams, this means:
- Urgent Patching: Seriously, if you run Ivanti products, patch yesterday.
- Forensic Investigation: Assume compromise. Hunt for indicators of compromise (IOCs) – CISA has provided a ton [4].
- Network Segmentation: Limit trust. These gateways are often perimeter devices, so contain potential breaches.
- Multi-Factor Authentication (MFA): Enforce it everywhere, especially for admin access.
- Supply Chain Risk: This highlights how critical third-party components can become single points of failure.
This isn’t just about Ivanti; it’s a stark reminder that our perimeter defenses are under constant, aggressive assault. We need to move beyond just patching reactive vulnerabilities and focus on building resilient, “assume breach” architectures. Your network isn’t a castle with an impenetrable wall; it’s a series of highly monitored, segmented zones. Act like it.
