CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

CVE-2024-21893 is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (formerly Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons. It allows an unauthenticated attacker to access certain restricted resources on the affected systems. These products commonly serve as remote access gateways and policy enforcement points, so successful abuse can expose internal services or sensitive functions that should remain protected.

The issue matters because it requires no authentication and has been tied to known ransomware activity. Organizations running these platforms should treat it as a high-priority risk and confirm exposure against the vendor advisory.

How it works

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). In an SSRF flaw, an attacker supplies a crafted request that causes the vulnerable server itself to initiate outbound connections or access resources on the attacker’s behalf. Here the flaw resides in the SAML component of the listed Ivanti products. An attacker can leverage it to reach certain restricted resources without authenticating. Exact request formats, reachable endpoints, and any chaining requirements are not detailed in the public summary; defenders must consult the vendor advisory for precise technical mechanics.

Because the products often sit at the network edge and handle authentication traffic, an SSRF in the SAML path can let an external actor probe or interact with internal interfaces that would otherwise be unreachable.

Am I affected? How to find it in your systems

Ivanti Connect Secure and Policy Secure are typically deployed as appliances or virtual appliances providing SSL VPN, remote access, and network access control. Ivanti Neurons is a related management or endpoint platform. Inventory any instances of these products in your environment, including older Pulse Secure branding.

• Search asset inventories, CMDB records, and network scans for hostnames, certificates, or management interfaces associated with Ivanti Connect Secure, Policy Secure, or Neurons.
• Identify whether SAML is configured or enabled; the vulnerability is located in the SAML component.
• Confirm the exact software versions and patch levels against the vendor advisory, as public details do not list specific version ranges here.
• Review authentication and system logs for anomalous SAML-related requests, unexpected outbound connections originating from the appliance, or access attempts to restricted internal resources. Unusual traffic patterns from the appliance itself may indicate exploitation attempts.

If the products are internet-facing or reachable from untrusted networks, prioritize them for immediate review.

How to remediate

Apply the mitigations or updates provided by the vendor as the primary remediation step. CISA directs organizations to follow the vendor’s instructions or to discontinue use of the product if mitigations are unavailable. After applying the fix, verify that SAML functionality continues to operate as expected and that the restricted resources are no longer reachable without authentication.

• Obtain and install the vendor-supplied update or mitigation package for each affected product.
• Re-validate SAML configuration and test authentication flows post-update.
• Harden the remaining surface by restricting management interfaces to trusted networks, enforcing least-privilege access, and ensuring the appliances are not unnecessarily exposed.

Document the remediation and retain evidence of the applied updates for audit purposes.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls focused on the SSRF class and the network position of these products.

• Segment the appliances so they cannot freely reach sensitive internal systems; limit outbound connectivity from the SAML-related components to only required destinations.
• Place a web application firewall or reverse proxy in front of the external interface and apply virtual-patching rules that block anomalous SAML or request-forging patterns (confirm signatures against current threat intelligence).
• If operationally feasible, temporarily disable or restrict the SAML component until a patch is available.
• Increase monitoring of appliance logs, outbound connections, and authentication events; alert on any access to restricted resources or unexpected internal requests originating from the device.
• Consider temporary network access control lists that deny unauthenticated external traffic to the SAML endpoints where possible.

These measures lower risk but do not replace the vendor fix.

If your data may have been exposed

This vulnerability has been associated with known ransomware use. Actively exploited remote-access flaws frequently lead to broader compromise and data exposure. If you believe an appliance was reachable and unpatched during the relevant period, treat the incident as a potential breach: isolate affected systems, preserve logs, and begin forensic review. As an additional check, you can run a free exposure scan of organizational email addresses against known breach data sets to determine whether credentials or other information have already appeared in public dumps.