Description
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Connect Secure | 22.7R2.1 – < 22.7R2.1, 9.1R18.9 – < 9.1R18.9 | 22.7R2.1 |
| Ivanti | Policy Secure | 22.7R1.1 – < 22.7R1.1 | 22.7R1.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection
exploit/linux/http/ivanti_connect_secure_rce_cve_2024_37404
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2024-0398 Kwetsbaarheden verholpen in Ivanti Connect Secure en Policy Secure NCSC-NL (Netherlands) · Oct 11, 2024
- WID-SEC-2024-3103 Ivanti Connect Secure und Policy Secure: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 8, 2024