Mitigate Ivanti Vulnerabilities: CISA Issues Emergency Directive

Rohan Timalsina

February 5, 2024 - TuxCare expert team

In recent times, the cybersecurity landscape has witnessed a surge in threats targeting Ivanti Connect Secure and Ivanti Policy Secure solutions. The Cybersecurity and Infrastructure Security Agency (CISA) has raised a red flag, highlighting the widespread and active exploitation of vulnerabilities in these Ivanti solutions, presenting an imminent risk to Federal Civilian Executive Branch (FCEB) agencies.

Ivanti Products Vulnerabilities

The vulnerabilities in question, namely CVE-2023-46805 and CVE-2024-21887, pose a serious threat to the security of information systems. CVE-2023-46805, identified in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure, allows a remote attacker to bypass authentication controls, potentially leading to unauthorized access to restricted resources.

On the other hand, CVE-2024-21887 is a command injection vulnerability found in the web components of the same Ivanti solutions. This vulnerability, exploitable over the internet, empowers an authenticated administrator to execute arbitrary commands on the affected products, creating a gateway for malicious activities.

When these vulnerabilities are exploited in conjunction, a malicious threat actor gains the ability to execute arbitrary commands on a vulnerable product. This can result in lateral movement within the system, data exfiltration, and the establishment of persistent access, ultimately leading to the full compromise of target information systems.

Mitigating Ivanti Vulnerabilities

Recognizing the severity of the situation, Ivanti took prompt action by releasing crucial information on January 10, 2024. The company disclosed details about the vulnerabilities and provided temporary mitigation in the form of an XML file. This file can be imported into affected products to make necessary configuration changes until a permanent update is made available.

Organizations must take proactive steps to secure their Ivanti solutions. Beyond the temporary fix provided by Ivanti, the following measures should be considered:

Regular Updates and Patch Management

Ensure that your Ivanti solutions are regularly updated with the latest patches and security updates because timely updates play a crucial role in mitigating potential vulnerabilities.

Network Segmentation

Implement network segmentation to limit the lateral movement of attackers within your system. This helps contain the impact of a potential breach and prevents unauthorized access to critical resources.

Continuous Monitoring and Incident Response

Employ robust monitoring tools to detect and respond to any unusual activities promptly. A proactive incident response plan ensures a swift and effective reaction to security incidents.

Conclusion

The active exploitation of vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure solutions underscores the critical importance of cybersecurity for organizations, particularly those within the Federal Civilian Executive Branch. By staying informed about the nature of these vulnerabilities and implementing effective mitigation strategies, organizations can bolster their defense against potential threats and ensure the security of their information systems.

The sources for this article include a story from CISA.

Summary