CVE-2024-21887: 
Ivanti Connect Secure vulnerability analysis and mitigation

A command injection vulnerability (CVE-2024-21887) was discovered in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x). The vulnerability allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance. This vulnerability has been actively exploited in the wild since December 2023, often being chained with CVE-2023-46805 (an authentication bypass vulnerability) to achieve unauthenticated remote code execution (WatchTowr Labs).

The vulnerability has been assigned a CVSS v3.1 base score of 9.1 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). When chained with CVE-2023-46805, it allows unauthenticated attackers to achieve remote code execution on affected devices (NVD).

The vulnerability enables authenticated administrators to execute arbitrary commands on the appliance, potentially leading to complete system compromise. When combined with CVE-2023-46805, it allows unauthenticated attackers to achieve full device compromise and takeover. This has significant implications as these devices often serve as critical gateway components between internal networks and the internet (WatchTowr Labs).

Ivanti has released patches for various versions including 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3, and 22.6R2.2 for Connect Secure, and 9.1R17.3, 9.1R18.4, and 22.5R1.2 for Policy Secure. For unpatched versions, Ivanti provides a mitigation XML script. It's recommended to perform a factory reset before applying the patch to prevent threat actors from maintaining persistence on compromised devices (Tenable Blog).

The security community has expressed significant concern about these vulnerabilities, particularly regarding the delayed patch release and the initial reliance on XML mitigation files. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive (ED 24-01) requiring Federal Civilian Executive Branch agencies to implement mitigations and later disconnect affected devices from their networks (Tenable Blog).