Days after Ivanti announced patches for a new vulnerability in its Connect Secure and Policy Secure products, proof-of-concept exploit code has already been published for the flaw and security companies are reporting exploitation attempts in the wild. This follows a difficult month for Ivanti customers who had to deploy emergency mitigations and patches for three different zero-day vulnerabilities that were being exploited in the wild.
The new vulnerability, tracked as CVE-2024-22024, is an XML external entity injection (XXE) in the SAML component of specific versions of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways. It allows an attacker to access certain restricted resources without authentication and is rated with a severity score of 8.3 out of 10 (high) on the CVSS scale.
Ivanti credits researchers from security firm watchTowr for discovering and reporting the flaw, but also notes that it had already flagged that code as potentially insecure internally. The watchTowr researchers said in a report that they found the flaw while analyzing the patch for CVE-2024-21893, a server-side request forgery (SSRF) vulnerability in the SAML component that Ivanti disclosed on January 31 as a zero-day flaw that was being exploited in targeted attacks.
The CVE-2024-21893 SSRF flaw itself was discovered by Ivanti while investigating two other zero-day vulnerabilities that were announced on January 10 and were being exploited by a Chinese advanced persistent threat (APT) group. In response to these attacks, Ivanti first released an XML-based mitigation that could be applied to affected devices while the company worked on updated versions for all affected software releases.
Updates available for the new Ivanti vulnerabilities
The updates for the four known vulnerabilities — CVE-2023-46805 (authentication bypass), CVE-2024-21887 (command injection), CVE-2024-21888 (privilege escalation), and CVE-2024-21893 (SSRF in the SAML component) — were finally released on January 31 and February 1.
Updates for the new CVE-2024-22024 (XXE injection) flaw were released on February 8. Ivanti said these updates supersede the previously released ones and noted that customers who reset their devices to factory reset when applying the January 31 and February 1 patches don’t have to do it again now after applying the February 8 updates. The factory reset was required to clear out any potential implants and modifications made by attackers using the previous exploits.
