Ivanti’s Nightmare Continues: New Vulnerabilities, Active Exploitation – Patch or Pay!
Alright folks, drop what you’re doing because Ivanti just dropped another bombshell. Their Connect Secure and Policy Secure gateways are under siege again, with new vulnerabilities actively being exploited in the wild. This isn’t just a drill; threat actors are already inside networks, leveraging these flaws for persistent access and data theft.
The latest addition to the Ivanti vulnerability hall of shame is CVE-2024-22024[1], an XML external entity (XXE) vulnerability in the SAML component. This bad boy allows an unauthenticated attacker to access restricted resources by bypassing authentication. Coupled with the previously disclosed (and still heavily exploited) vulnerabilities like CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893[2], attackers can chain these exploits to achieve unauthenticated remote code execution and maintain persistent backdoor access to your network. Multiple state-sponsored and financially motivated groups are having a field day with these[3].
So, what does this mean for you, the developer or security team? It means if you’re running Ivanti Connect Secure or Policy Secure gateways, you’re a prime target. These vulnerabilities allow attackers to bypass authentication, run arbitrary commands, and exfiltrate data. We’re talking full network compromise here, folks. The “patch now” message isn’t strong enough; if you haven’t applied the latest patches and hotfixes, or run their external integrity checker, you’re essentially leaving your front door wide open while waving a “free data inside” sign. You need to assume compromise if you haven’t acted immediately[4].
Don’t wait for your CISO to panic. Get those patches deployed, run integrity checks, and hunt for indicators of compromise. This isn’t just about patching; it’s about validating your network hasn’t already been breached. Time is not on your side.
