Description
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | ICS | 9.1R18 – ≤ 9.1R18, 22.6R2 – ≤ 22.6R2 | — |
| Ivanti | IPS | 9.1R18 – ≤ 9.1R18, 22.6R1 – ≤ 22.6R1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Ivanti Connect Secure Unauthenticated Remote Code Execution
exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805
-
Ivanti Connect Secure Unauthenticated Remote Code Execution
exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893
GitHub 8 repositories
-
Chocapikk/CVE-2024-21887 ★ 58 · Jan 16, 2024
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests …
-
duy-31/CVE-2023-46805_CVE-2024-21887 ★ 23 · Jan 16, 2024
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
-
seajaysec/Ivanti-Connect-Around-Scan ★ 12 · Jan 19, 2024
Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.
-
oways/ivanti-CVE-2024-21887 ★ 7 · Jan 14, 2024
POC Checker for ivanti CVE-2024-21887 Command injcetion
-
Hexastrike/Ivanti-Connect-Secure-Logs-Parser ★ 6 · Jan 19, 2025
A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.
-
raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887 ★ 5 · Jan 18, 2024
The script in this repository only checks whether the vulnerabilities specified in the Ivanti Connect Secure product exist.
-
rxwx/pulse-meter ★ 1 · Jan 14, 2025
Parses the System Snapshot from an Ivanti Connect Secure applicance to identify possible IOCs related to CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.
-
pwniel/ivanti_shell ★ 0 · Feb 24, 2024
CVE-2024-21887 Exploitation with Ngrok Reverse Shell
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection http/cves/2024/CVE-2024-21887.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2024-0059 Ivanti Connect Secure: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 10, 2024