Cybereason issues Threat Alerts to inform customers of emerging impacting threats, including critical vulnerabilities such as the Ivanti Connect Secure VPN Zero-Day exploitation. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them.
Cybereason Security Services and Incident Response Teams are investigating incidents that involve exploitation of recently disclosed vulnerabilities in Ivanti VPN appliances, not patched at the time of disclosure (zero-days).
On 10 January 2024, Ivanti disclosed two critical vulnerabilities identified as CVE-2023-46805 and CVE-2024-21887 affecting their Connect Secure and Policy Secure solutions, urging customers to apply immediate mitigations. These vulnerabilities pose severe risks, enabling unauthorized command execution and system access on Internet-facing security devices. Following the disclosure, both Volexity and Mandiant released reporting revealing that widespread exploitation of these vulnerabilities began as early as December 2023.
On 16 January 2024, a third party released a public Proof of Concept (PoC) resulting in further escalation of exploitation. Adding to the current threat, on January 31st, Ivanti announced two more vulnerabilities, CVE-2024-21888 (a privilege escalation flaw) and CVE-2024-21893 (a SSRF web vulnerability) amplifying the need for both action and heightened security awareness as efforts by the manufacturer remain underway to develop and deliver appropriate mitigations.
CVE-2023-46805 and CVE-2024-21887 have enabled attackers to conduct a range of malicious activities, significantly impacting the security posture of affected organizations.
CVE-2023-46805, an authentication-bypass vulnerability, allows attackers to gain unauthorized access to the VPN appliances by circumventing authentication mechanisms. This vulnerability compromises the integrity of secure VPN tunnels, exposing private internal networks to potential espionage and data theft.
CVE-2024-21887, a command-injection vulnerability, permits authenticated attackers to execute arbitrary commands on the system. This level of access provides attackers with the capability to steal sensitive configuration data, manipulate existing system files, download additional malicious payloads, and establish reverse tunnels for persistent access and data exfiltration.
In incidents observed by Volexity, attackers exploited these vulnerabilities to modify legitimate Ivanti Connect Secure components. Specifically, attackers were seen backdooring the compcheckresult.cgi file, available from the web interface of the VPN device, to enable remote command execution and altering JavaScript files within the Web SSL VPN component to capture and exfiltrate user login credentials. This allowed attackers not only to maintain persistent access within the network but also to escalate privileges and move laterally, targeting sensitive internal systems and data.
The additional vulnerabilities disclosed by Ivanti on 31 January 2024, CVE-2024-21888 and CVE-2024-21893, also allow for unauthenticated remote command execution with elevated privileges, thereby increasing the attack surface for malicious actors.
The impact of these vulnerabilities is profound, enabling attackers to bypass multi-factor authentication, steal confidential information, establish covert command and control channels, and potentially disrupt critical operations.
Attack Flow Diagram Related To CVE-2023-46805 & CVE-2024-21887
Analysis by Mandiant indicates that these vulnerabilities have been first actively exploited by a suspected China-nexus espionage threat actor, known as UNC5221, as well as other uncategorized threat groups through automated methods.
This broad exploitation activity underscores the attractiveness of these vulnerabilities to a wide range of actors, including state-sponsored groups and cybercriminals, for objectives ranging from strategic intelligence gathering to financial gain.
The investigation into the exploitation of Ivanti vulnerabilities has yielded several critical observations, shedding light on the tactics, techniques, and procedures (TTPs) employed by attackers, as well as the broader implications of these security breaches.
The four vulnerabilities of the Ivanti Connect Secure VPN Zero-Day Exploitation can be combined together to perform remote control execution, privilege escalation as well as exfiltration of sensitive data, ultimately leading to threat actors accessing the victim’s internal network.
This vulnerability allows an unauthenticated attacker to access restricted resources by bypassing control checks. The exploit utilizes path traversal attack by sending a GET request to Ivanti Connect Secure public facing endpoint with URL path /api/v1/totp/user-backup-code.
The path traversal attack allows an attacker to access the contents of the system folder:
Ivanti has released a patch for the vulnerability by defining an accepted list of permitted values (whitelisting).
This vulnerability allows an authenticated attacker to send specially crafted requests and execute arbitrary commands on the appliance. The attacker accesses the endpoint /api/v1/license/ via path traversal vulnerability (CVE-2023-46805) and sends a GET request with the attacker's payload appended to the endpoint for post-exploitation.
The vulnerability in the web component of the Ivanti Connect Secure and Ivanti Policy Secure Gateway enables an authenticated user to gain admin privileges.
The vulnerability in Ivanti SAML component implementation allows an unauthenticated attacker to access certain restricted resources by utilizing server-side request forgery. The vulnerability affects the Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons devices.
SAML is a standard used by single sign-on (SSO) providers to authenticate users. Ivanti Connect Secure uses SAML to implement web browser SSO. Ivanti Connect Secure Entity can configure SAML service provider, SAML Identity provider or both. Based on the patch file analysis, the following SAML CGI links have been patched for the SSRF attack vulnerability.
Cybereason lists some of the known post-exploitation activities reported by various security vendors. As of the writing of this report, the reported exploitation observed in the wild are the combinations of CVE-2023-46805 and CVE-2024-21887.
Threat actors exploited CVE-2023-46805 and CVE-2024-21887 to deliver coinminers to the Ivanti Connect Secure appliances. The known execution flow to deliver coin miners are as follows.
Exploit CVE-2023-46805 and CVE-2024-21887 to execute cURL/wget command to download and execute a shell script
Creates persistence via service or cron
Execute Coinminer
Coinminer Execution Flow
Once threat actors deploy necessary tools and malwares, threat actors potentially move to the next step which is to harvest credentials. The credential harvesting can lead to lateral movement and allow threat actors to further compromise the enterprise network.
One of known credential harvesters that are deployed to the compromised Ivanti Connect Secure appliances is WARPWIRE, dubbed by Mandiant. WARPWIRE is a Javascript-based credential harvester, which targets plaintext username and passwords. The WARPWIRE captures credentials for web logon to access layer 7 applications such as RDP.
Through successful credential harvesting, threat actors can move laterally into the target network to conduct further exfiltration of credentials, such as LSASS credential dumping.
Post-Exploitation Of CVE-2023-46805 And CVE-2024-21887 Leading To Credential Dumping
To maintain persistence within the environment, threat actors deploy webshells. Currently in the wild, there are two known types of webshells.
Cybereason recommends the following actions:
Below is a list of Indicator of Compromises (IoC) associated with known post-exploitation activities of Ivanti Connect Secure vulnerabilities are as follows.
|
Type |
Value |
Comment |
|
MD5 |
8eb042da6ba683ef1bae460af103cc44 |
WARPWIRE credential harvester variant |
|
MD5 |
a739bd4c2b9f3679f43579711448786f |
WARPWIRE credential harvester variant |
|
MD5 |
a81813f70151a022ea1065b7f4d6b5ab |
WARPWIRE credential harvester variant |
|
MD5 |
b15f47e234b5d26fb2cc81fc6fd89775 |
WARPWIRE credential harvester |
|
MD5 |
d0c7a334a4d9dcd3c6335ae13bee59ea |
WARPWIRE credential harvester |
|
MD5 |
e8489983d73ed30a4240a14b1f161254 |
WARPWIRE credential harvester variant |
|
MD5 |
3045f5b3d355a9ab26ab6f44cc831a83 |
CHAINLINE web shell |
|
MD5 |
3d97f55a03ceb4f71671aa2ecf5b24e9 |
LIGHTWIRE web shell |
|
MD5 |
2ec505088b942c234f39a37188e80d7a |
WARPWIRE credential harvester variant |
|
MD5 |
465600cece80861497e8c1c86a07a23e |
FRAMESTING web shell |
|
IP |
8[.]137[.]112[.]245 |
Malware Hosting |
|
IP |
50[.]215[.]39[.]49 |
Malware Hosting |
|
IP |
146[.]0[.]228[.]66 |
Malware Hosting |
|
IP |
186[.]179[.]39[.]235 |
Malware Hosting |
|
IP |
91[.]92[.]254[.]14 |
Malware Hosting |
|
IP |
159[.]65[.]130[.]146 |
Malware Hosting |
|
IP |
173[.]220[.]106[.]166 |
Malware Hosting |
|
IP |
45[.]61[.]136[.]14 |
Malware Hosting |
|
URL |
symantke[.]com |
WarpWire C2 |
|
URL |
Secure-cama[.]com |
WarpWire C2 |
|
URL |
request[.]data |
WarpWire C2 |
|
URL |
miltonhouse[.]nl |
WarpWire C2 |
|
URL |
logclear[.]pl |
WarpWire C2 |
|
URL |
line-api[.]com |
WarpWire C2 |
|
URL |
entraide-internationale[.]fr |
WarpWire C2 |
|
URL |
ehangmun[.]com |
WarpWire C2 |
|
URL |
duorhytm[.]fun |
WarpWire C2 |
|
URL |
clicko[.]click |
WarpWire C2 |
|
URL |
clickcom[.]click |
WarpWire C2 |
|
URL |
areekaweb[.]com |
WarpWire C2 |
Nicholas Mangano, GSOC Analyst
Nick Mangano is a Senior GSOC Analyst with the Cybereason Global SOC team. He is involved with active MalOp investigation and remediation. Previously, Nick worked as a Security Analyst with Seton Hall University while completing his undergraduate degree. Nick holds an Accounting and Information Technology Degree as well as a Cybersecurity Certification from Seton Hall University. He is interested in malware analysis as well as digital forensics.
Hema Loganathan, GSOC Analyst
Hema Loganathan is a GSOC Analyst with the Cybereason Global SOC team. She is involved in MalOp Investigation, Malware Analysis, Reverse Engineering and Threat Hunting. Hema has a Master of Science degree in Information Systems.
Kotaro Ogino, CTI Analyst
Kotaro is a CTI Analyst with the Cybereason Security Operations team. He is involved in threat hunting, threat intelligence enhancements and Extended Detection and Response (XDR). Kotaro has a bachelor of science degree in information and computer science.
Cybereason issues Threat Alerts to inform customers of emerging threats, including critical vulnerabilities such as CitrixBleed. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them.
Cybereason issues Threat Alerts to inform customers of emerging impacting threats, including new ransomware actors such as the emergent group INC Ransom. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them.
