CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

CVE-2024-21887 is a command injection vulnerability in the web components of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure. An authenticated administrator can send crafted requests that result in code execution on the affected appliance. The issue can be leveraged together with CVE-2023-46805, an authentication bypass, which expands the practical attack surface.

These appliances commonly serve as remote-access and policy-enforcement gateways, so successful exploitation can give an attacker control of a high-value network entry point. The vulnerability has been observed in ransomware operations, making prompt assessment and remediation essential for any organization running the products.

How it works

The flaw is categorized as CWE-77 (improper neutralization of special elements used in a command). Within the web components of the listed Ivanti products, an authenticated administrator can craft requests that inject operating-system commands. Because the injection occurs in a privileged context on the appliance itself, the result is arbitrary code execution.

When chained with the related authentication-bypass issue, an attacker who has not yet obtained legitimate administrative credentials may still reach the vulnerable functionality. Exact request formats and payload construction are not detailed here; defenders must consult the vendor advisory for any technical indicators or proof-of-concept descriptions that have been released.

Am I affected? How to find it in your systems

Ivanti Connect Secure and Policy Secure typically appear as dedicated network appliances or virtual appliances that provide SSL VPN, remote-access, and access-policy services. They are frequently placed at the network edge or in DMZ segments.

• Inventory all remote-access and policy-enforcement gateways; look for devices identified as Ivanti Connect Secure, Pulse Connect Secure, or Ivanti Policy Secure in asset-management, configuration-management, or network-discovery tools.
• Record the software version and build of every instance and compare it against the affected-version list published in the vendor advisory; do not rely on version numbers stated elsewhere.
• Review administrative-access logs and web-server logs for unusual request patterns originating from administrative sessions, especially any that coincide with periods of known exploitation activity. Specific log signatures must be confirmed against vendor or CISA guidance.
• Check whether the appliances are reachable from untrusted networks and whether multi-factor authentication or other access controls are enforced for administrative interfaces.

How to remediate

The primary action is to apply the mitigations or software updates supplied by Ivanti, exactly as described in the vendor advisory. CISA’s required action is to apply those vendor mitigations or to discontinue use of the product if mitigations are unavailable.

• Obtain the official update package or mitigation package from Ivanti and deploy it according to the vendor’s installation instructions.
• After applying the fix, verify that the appliance reports the expected patched state and that administrative functionality continues to operate normally.
• As a general hardening step for command-injection classes, restrict administrative access to the web interface to a small set of trusted management networks and enforce strong authentication.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls that limit both reachability and the impact of any successful injection.

• Place the appliances behind network segmentation that isolates them from general user and internet traffic; allow only necessary management and VPN ports.
• Deploy a web-application firewall or virtual-patching rule set that inspects and blocks anomalous requests to the web components; tune rules carefully to avoid disrupting legitimate administrative use.
• Temporarily disable any non-essential web-management features if the vendor documentation permits doing so without breaking core VPN or policy functions.
• Increase monitoring of authentication events, process-creation logs, and outbound connections from the appliances so that anomalous activity can be detected quickly.

If your data may have been exposed

Vulnerabilities that are actively exploited and known to be used in ransomware campaigns frequently lead to broader network compromise and data theft. Organizations that discover evidence of exploitation should treat the incident as a potential breach, preserve forensic artifacts, and follow their incident-response plan. Separately, individuals can run a free exposure scan of their email addresses against publicly known breach data sets to determine whether personal credentials have already appeared in prior incidents.