CVE-2024-21887 — Ivanti Connect Secure command injection chain

CVE-2024-21887 — Ivanti Connect Secure command injection chain

TL;DR: A command-injection bug in Ivanti Connect Secure / Policy Secure (CVE-2024-21887), chained with a separate authentication bypass (CVE-2023-46805), gave unauthenticated remote code execution. Disclosed by Volexity as in-the-wild exploitation (UTA0178). The chain is a canonical edge-appliance two-bug stack: bypass auth + reach a sink that takes user input into a shell. Companion to cve-2024-3400-globalprotect-command-injection and cve-2024-21762-fortios-out-of-bounds.

Why this matters

  • A two-bug chain, not a single CVE — teaches how chains turn medium impact into critical.
  • Pre-auth on Ivanti Connect Secure, formerly Pulse Secure — high-density target.
  • Volexity disclosed alongside in-the-wild abuse; Ivanti’s response was multi-stage with several follow-up CVEs.
  • The chain became a teaching example for patch is not enough — operators who patched but didn’t IR remained compromised.

The two bugs

CVE-2023-46805 — auth bypass

Path-based authentication gate could be bypassed by URL-encoding or path traversal. Sending requests to admin paths with carefully chosen .. or encoded characters caused the gateway to pass the request through to the back-end handler without authentication.

CVE-2024-21887 — command injection

A web endpoint took a parameter and concatenated it into a system command. With the auth bypass, an unauthenticated request could reach the vulnerable endpoint and inject shell.

The chain

  1. Send the auth-bypassed request to the admin endpoint.
  2. Endpoint hands off to the command-injection sink.
  3. Shell-metachar payload runs as the appliance user.

Two HTTP requests = root on the appliance. From there: harvest configuration, SAML SP keys, RADIUS shared secrets, OAuth client secrets, internal certificates.

In-the-wild observations

Volexity’s UTA0178 (later attributed to Chinese threat actors):

  • Deployed WIREFIRE and LIGHTWIRE webshells.
  • Modified Ivanti’s compcheck.cgi and Python utilities to add persistence.
  • Used the appliance as an internal pivot.
  • Operated for months in some environments before disclosure.

Subsequent CVE-2024-22024 and others were chained variants found during incident response.

The patch shape

The auth bypass patch added a normalised-path comparison before route dispatch. The command injection patch switched to subprocess-style argument lists with no shell interpretation.

Same pattern as cve-2024-3400-globalprotect-command-injection — appliances repeatedly ship “user input → shell” via legacy code.

Affected versions

  • Ivanti Connect Secure 9.x, 22.x.
  • Ivanti Policy Secure 9.x, 22.x.

Initial patches were partial; Ivanti released several follow-ups through Q1 2024. Operators who applied the first patch but not the follow-ups remained vulnerable.

Recovery realities

Patching alone was insufficient. Ivanti’s recommendation:

  • Apply patches.
  • Run Ivanti’s Integrity Checker Tool.
  • Factory reset the appliance.
  • Restore configuration from clean backup.
  • Rotate every credential / certificate / SAML key the appliance held.

Many organisations skipped the factory reset and remained compromised. The lesson: edge appliance breach assumes secrets are gone.

Workflow to reproduce

  1. Acquire a known-vulnerable Ivanti Connect Secure ICS image.
  2. Set up in PSA-V (virtual appliance).
  3. Send the auth-bypass URL, then the command-injection POST.
  4. Validate root-level execution.
  5. Examine /home/runtime/ for typical webshell drop locations used by UTA0178.

Public reproductions (watchTowr, Rapid7) released within days of disclosure.

Lessons

  • Chain bugs survive partial patches. Patch CVE-A and the chain breaks; the next variant of A re-enables it.
  • IR is part of the patch. Edge appliance patching without IoC sweep leaves persistence.
  • Vendor IoC tools are a baseline, not a guarantee. Sophisticated actors patch the tool too.
  • Threat-intel disclosure (Volexity here) often beats vendor disclosure timing. Subscribe to vendor-adjacent CTI feeds.
  • CVE-2024-22024 (XXE), CVE-2024-21888 (privilege escalation), CVE-2024-22023 (DoS) — follow-ups in early 2024.
  • CVE-2025-22457 (Connect Secure stack overflow) — different class, same surface.

References