New Ivanti Zero-Day Exploits Emerge After First Patches

In a recent development, Ivanti has warned of new zero-day vulnerabilities in its Connect Secure VPN appliance, first exploited by Chinese state-backed hackers in early December 2023. Identified as CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893, these flaws put customer networks at risk of unauthorized access and data theft.

The disclosure warns of two new zero-days being actively exploited. CVE-2024-21888 is a privilege escalation vulnerability affecting the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure, allowing attackers to obtain administrator privileges. CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA. Hackers can exploit it to gain access to restricted resources by bypassing authentication.

In its latest advisory, Ivanti warns that the attack appears to be “targeted,” and that they expect a sharp increase in exploitation. As of February 1st 2024, Ivanti has released patches addressing all four known vulnerabilities. At the time of writing, they stated that they were aware of 20 customers impacted by the vulnerabilities prior to going public with the news.

On top of installing this latest round of patches, Ivanti recommends customers factory reset their applications beforehand.

As reported by TechCrunch, Germany's Federal Office for Information Security (BSI) has reported multiple compromised systems due to these vulnerabilities. The BSI also stressed the fact that the newly discovered flaws “put all previously mitigated systems at risk again.”

The cybersecurity firms Volexity and Mandiant previously attributed the initial exploitation to a Chinese government-backed hacking group motivated by espionage. On the other hand, Ivanti has not attributed blame to a single entity. However, the fact that the vulnerabilities seem to be impacting sensitive industries, such as aerospace, banking, defense, government, and telecoms, seems to support Volexity and Mandiant’s observation.