Description
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | ICS | 9.1R18 – ≤ 9.1R18, 22.6R2 – ≤ 22.6R2 | — |
| Ivanti | IPS | 9.1R18 – ≤ 9.1R18, 22.6R1 – ≤ 22.6R1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Ivanti Connect Secure Unauthenticated Remote Code Execution
exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893
GitHub 2 repositories
-
h4x0r-dz/CVE-2024-21893.py ★ 94 · Feb 2, 2024
CVE-2024-21893: SSRF Vulnerability in Ivanti Connect Secure
-
Chocapikk/CVE-2024-21893-to-CVE-2024-21887 ★ 27 · Feb 3, 2024
CVE-2024-21893 to CVE-2024-21887 Exploit Toolkit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ivanti SAML - Server Side Request Forgery (SSRF) http/cves/2024/CVE-2024-21893.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2024-0262 Ivanti Connect Secure: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 1, 2024