[Update] Multiple vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (January 11, 2024)

CERT-FR Alert Bulletin Subject: [Update] Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways Document Management A detailed version management is found at the end of this document. Risks - Circumvention of security policy - Remote arbitrary code execution - Privilege escalation Affected Systems - Ivanti Connect Secure (ICS, formerly Pulse Connect Secure) all versions - Ivanti Neurons for ZTA gateways, all versions, currently in installation and not connected to a ZTA controller - Ivanti Policy Secure gateways (IPS) all versions Summary [Update March 4, 2024] Ivanti published resolution recommendations for Ivanti Connect Secure or Policy Secure in virtual machines on February 29th [16]. [Update February 15, 2024] The vendor published patches for the following versions, for which they were not yet available: - Ivanti Connect Secure versions 9.1R15.3, 9.1R16.3, 22.1R6.1, 22.2R4.1, 22.3R1.1, and 22.4R1.1 - Ivanti Policy Secure versions 9.1R16.3, 22.4R1.1, and 22.6R1.1 [Update February 9, 2024] Addition of vulnerability CVE-2024-22024 The publication of the first vulnerabilities followed the vendor's discovery of their targeted exploitation, likely since 2023. The exploitation of these vulnerabilities would have allowed attackers to laterally move and recover credentials on compromised Ivanti devices. Subsequently, exploit code, then new vulnerabilities, were published in mid-January. All these vulnerabilities are being massively exploited. On February 8, 2024, Ivanti published a security bulletin regarding the vulnerability CVE-2024-22024, affecting Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways. Details of the vulnerable versions are available in the solution section. It allows an unauthenticated attacker to access restricted resources. Researchers who discovered this vulnerability published a proof of concept. [Update February 4, 2024] Addition of recommendations for cluster configuration [Update February 2, 2024] Patches available for Ivanti Connect Secure 22.5R2.2 and Ivanti Policy Secure 22.5R1.1. Clarification of the procedure. [Update February 1, 2024] Merging of the solution and temporary workaround [Version January 31, 2024] Addition of information on patches and new vulnerabilities The vendor has published information regarding two new vulnerabilities. The vulnerability CVE-2024-21888 allows privilege escalation on the web component. The vulnerability CVE-2024-21893 allows an unauthenticated attacker to forge server-side requests (SSRF) through the SAML component. This latter is actively exploited. Patches are available, please refer to the Solution section. CERT-FR is aware of attempts to circumvent the ICT tool even if the external version is used. [Version January 23, 2024] Malicious actors are massively exploiting the vulnerabilities to exfiltrate accounts and passwords that may have passed through the vulnerable devices. The vulnerability CVE-2023-46805 allows an attacker to bypass authentication, while the vulnerability CVE-2024-21887 allows a remote and authenticated administrator to execute arbitrary commands. An attacker exploiting these two vulnerabilities can therefore take full control of the device. Ivanti indicates that these vulnerabilities are actively exploited in the context of targeted attacks. CERT-FR is aware of many compromised devices. Different sources have mentioned the exploitation of these vulnerabilities to establish persistence methods on the equipment [1][3]. Public exploit code is available on the Internet to exploit the two vulnerabilities subsequently. Detection [Version January 23, 2024] To know if you are affected by these attacks, CERT-FR proposes the following actions: - Run the Integrity Check Tool script published by IVANTI [5] on all equipment in the cluster. If there are non-zero results in steps 8 and 9, the equipment is compromised; - The attacker may try to bypass the controls performed by the ICT, so it is also necessary to search the logs for any trace of markers published by public sources [1] [3] [11] [12] [13] [14]. Note: These indicators have not been qualified by CERT-FR. In case of positive detection: - Perform a data freeze (snapshots for virtual Appliances, isolation of the equipment if it is a physical device). Once the data freeze is performed or if it is impossible to maintain isolation of physical devices, proceed with the workaround measures and recommendations mentioned in the following section. - Report the event to CERT-FR, copying your relevant business CSIRTs. CERT-FR will contact you if necessary for incident handling or provide you with additional information. Furthermore, CERT-FR regularly performs scans from the IPs mentioned on the associated page [6] and contacts the entities identified as vulnerable or compromised. Workaround [Update February 1, 2024] Merging of the solution and temporary workaround Following the update of the vendor's documentation and the availability of new patches, the procedure to follow has been moved to the Solution section. [Update January 31, 2024] Addition of information on the new workaround measure The vendor has published a new mitigation workaround: release.20240126.5.xml [15]. This allows protection against vulnerabilities CVE-2024-21888 and CVE-2024-21893 as well as the vulnerabilities CVE-2023-46805 and CVE-2024-21887. Patches are presented in the Solution section; the workaround measure should only be applied if patches are not available for the affected products. [Version January 23, 2024] The vendor indicates that they are aware of public internet exploits and a mass exploitation of the two vulnerabilities subsequently. Any device whose initial temporary workaround (importing the xml file) has not already been applied must be considered compromised. If the ICT results indicate a compromise (non-zero results in steps 8 and 9) or if the initial temporary workaround (importing the xml file) has not been performed, CERT-FR strongly recommends following the procedure documented by the vendor [4] for bringing a compromised device back online. Additional Recommendations from cert-fr Due to the compromise of the equipment and the possibility that the attacker injected malicious code to recover usernames and passwords, CERT-FR recommends: - Reset all secrets (in general) configured on the affected equipment; - Reset all authentication secrets that may have passed through the affected equipment; - Search for all traces of lateral movement on the rest of the information system. Solution [Update March 4, 2024] Ivanti recommends that customers using Ivanti Connect Secure or Policy Secure in virtual machines no longer perform a factory reset but rather start from an image (template). Resolution Procedure for Ivanti Connect Secure or Policy Secure in virtual machines: - Back up the configuration - Deploy a new machine from an image (template) from the vendor's site - Restore the configuration from the backup - Perform a rotation of secrets [Update February 15, 2024] Publication of new security patches. Ivanti has published a patch for the vulnerability CVE-2024-22024 for the following products: - Ivanti Connect Secure versions 9.1R14.5, 9.1R15.3, 9.1R16.3, 9.1R17.3, 9.1R18.4, 22.1R6.1, 22.2R4.1, 22.3R1.1, 22.4R1.1, 22.4R2.3, 22.5R1.2, 22.5R2.3, and 22.6R2.2 - Ivanti Policy Secure versions 9.1R16.3, 9.1R17.3, 9.1R18.4, 22.4R1.1, 22.5R1.2, and 22.6R1.1 - ZTA gateways versions 22.5R1.6, 22.6R1.5, and 22.6R1.7 [Update February 9, 2024] Addition of vulnerability CVE-2024-22024 If a patch was applied with versions from 1/31 to 2/1, CERT-FR recommends performing the following actions before applying the patch: - Perform a backup - Scan the external ICS - If there is a positive scan on the external ICS before the update, a factory reset is necessary. Subsequently, once the patch is applied, if a factory reset has already been performed during the application of the January 31st or February 1st patch, the vendor indicates that a new factory reset is not necessary. Finally, for vulnerable equipment that does not yet have a patch, the vendor recommends applying the workaround measure published on January 31st (file mitigation.release.20240126.5.xml). [Update February 4, 2024] Addition of recommendations for cluster configuration Additional recommendation for cluster configurations: Refer to the vendor's documentation in the "Additional Detail for Recovering Clusters" section [Update February 2, 2024] The vendor continues to publish corrective versions. Patches are now available for Ivanti Connect Secure versions 22.5R2.2 and Ivanti Policy Secure 22.5R1.1 [Update February 1, 2024] Merging of the solution and temporary workaround The vendor has published patches for Ivanti Connect Secure in versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, and 22.5R1.1, and for ZTA in version 22.6R1.3 [0][15]. The following procedure, proposed by the vendor, can be followed regardless of patch availability for the equipment. If a patch is unavailable, the workaround file must be installed. - Back up the equipment configuration; - Perform a factory reset AND perform a firmware upgrade if the patch is available: - the procedure is documented in the vendor's bulletin [7], - A version upgrade will delete/overwrite files added/modified by the attacker, - Firmware versions can be downloaded from the vendor's page [8], - NOTE: Rolling back to the compromised version will make the device vulnerable. Two version upgrades remove the compromised version since only one rollback version is kept on the equipment; - If it is not possible to install a version with the patch, once the factory reset is complete, perform an update to the previously installed version; - Restore the equipment configuration from the backup: [9] [10]; - If you have applied the XML workaround measure and applied the corrected firmware version, remove the XML (How to Add and Remove XML files to your Ivanti Connect Secure and Ivanti Policy Secure Appliances: https://forums.ivanti.com/s/article/Download-Links-Related-to-CVE-2023-46805-and-CVE-2024-21887) - Revoke and reissue all certificates on the affected equipment: - Certificates used for machines and/or for user authentication (client and server side), - Code signing certificates and TLS certificates for the exposed interface; - Reset the administration password; - Reset API keys stored on the equipment; - Reset passwords for all local accounts defined on the gateway, including service accounts used in the configuration related to authentication servers. - Reset license server authentications; - If your firmware is not on a patched version, install the workaround file (file .xml) on the healthy equipment. Otherwise, installing the xml file is not necessary. Once the workaround is installed, no further configuration should be pushed to the equipment until the security patch is applied. This is because the vendor indicates that this causes malfunctions in some internal services, which makes the workaround ineffective. The use of workaround measures is not necessary after updating the equipment to a non-vulnerable version. The vendor offers a workaround tool if it was applied before the update. Documentation - [0] Ivanti Security Bulletin 000090123 of January 10, 2024 https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways - [1] Volexity Blog of January 10, 2024 https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/ - [2] Best practices in case of intrusion on an information system /best-practices-in-case-of-intrusion-on-an-information-system/ - [3] Mandiant Blog of January 12, 2024 https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day - [4] Ivanti Technical Bulletin of January 16 updated January 19, 2024 https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US - [5] Ivanti Technical Bulletin related to Integrity Check Tool https://forums.ivanti.com/s/article/KB44755 - [6] CERT-FR page regarding scans /scans/ - [7] Ivanti Technical Bulletin related to equipment reset https://forums.ivanti.com/s/article/KB22964 - [8] Ivanti Technical Bulletin related to firmware download https://forums.ivanti.com/s/article/Post-Factory-Reset-Legacy-Package-Download - [9] Ivanti Technical Bulletin related to data restoration https://forums.ivanti.com/s/article/KB44759 - [10] Ivanti Technical Bulletin related to data restoration https://forums.ivanti.com/s/article/KB44172 - [11] Twitter Post of January 22, 2024 https://twitter.com/felixaime/status/1749454051601776979 - [12] Volexity Blog of January 18, 2024 https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/ - [13] List of compromise indicators published by HarfangLab on January 22, 2024 https://raw.githubusercontent.com/HarfangLab/iocs/main/iv_lastauthserverused_js/20240122_lastauthserverused_js.txt - [14] JPCert Security Alert of January 11, 2024 https://www.jpcert.or.jp/at/2024/at240002.html - [15] Vendor Download Portal https://forums.ivanti.com/s/product-downloads - [16] Ivanti Blog on Enhanced External Integrity Checker Tool https://www.ivanti.com/blog/enhanced-external-integrity-checking-tool-to-provide-additional-visibility-and-protection-for-customers-against-evolving-threat-actor-techniques-in-relation-to-previously-disclosed-vulnerabilities - CERT-FR Opinion CERTFR-2024-AVI-0085 of January 31, 2024 /opinion/CERTFR-2024-AVI-0085/ - CERT-FR Opinion CERTFR-2024-AVI-0109 of February 9, 2024 /opinion/CERTFR-2024-AVI-0109/ - Ivanti Security Bulletin of February 8, 2024 https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways-282024 - Details of vulnerability CVE-2024-22024 https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US - Additional Recommendation for cluster configurations https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US - CVE Reference CVE-2023-46805 https://www.cve.org/CVERecord?id=CVE-2023-46805 - CVE Reference CVE-2024-21887 https://www.cve.org/CVERecord?id=CVE-2024-21887 - CVE Reference CVE-2024-21888 https://www.cve.org/CVERecord?id=CVE-2024-21888 - CVE Reference CVE-2024-21893 https://www.cve.org/CVERecord?id=CVE-2024-21893 - CVE Reference CVE-2024-22024 https://www.cve.org/CVERecord?id=CVE-2024-22024