Description
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | ICS | 9.1R14.5 – < 9.1R14.5, 9.1R17.3 – < 9.1R17.3, 9.1R18.4 – < 9.1R18.4, 22.1R6.1 – < 22.1R6.1, 22.2R4.1 – < 22.2R4.1, 22.3R1.1 – < 22.3R1.1, 22.4R1.1 – < 22.4R1.1, 22.5R1.2 – < 22.5R1.2, 22.6R1.1 – < 22.6R1.1, 22.4R2.3 – < 22.4R2.3, 22.5R2.3 – < 22.5R2.3, 22.6R2.2 – < 22.6R2.2 | 9.1R14.5 |
| Ivant | ICS | 9.1R15.3 – < 9.1R15.3 | 9.1R15.3 |
| Ivanti | IPS | 9.1R18.4 – < 9.1R18.4, 9.1R17.3 – < 9.1R17.3, 22.5R1.2 – < 22.5R1.2 | 9.1R18.4 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
0dteam/CVE-2024-22024 ★ 31 · Feb 9, 2024
Check for CVE-2024-22024 vulnerability in Ivanti Connect Secure
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ivanti Connect Secure - XXE http/cves/2024/CVE-2024-22024.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2024-0325 Ivanti Connect Secure and Ivanti Policy Secure: Schwachstelle ermöglicht Umgehung von Sicherheitsmechanismen BSI CERT-Bund (WID) · Feb 8, 2024