[HIGH PRIORITY] Ivanti Connect Secure Command Injection (CVE-2024-21887)

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-21887 is an authenticated command injection in Ivanti Connect Secure. Chained with CVE-2023-46805 (auth bypass), unauthenticated attackers execute arbitrary commands as root on the VPN appliance Linux OS.

Affected products

• Ivanti Connect Secure 9.x and 22.x before vendor fixes (Jan 2024 wave)
• Ivanti Policy Secure and ICS appliances
• Internet-exposed /dana-na/ endpoints

Check build

show version
curl -sk https://vpn.example.com/dana-na/auth/url_default/welcome.cgi

Patching Method

1. Apply Ivanti cumulative patch from advisory ICSA-2024-01-XX (minimum ICS 9.1R14.4 / 22.7R2.1).
2. Use Ivanti ICT (Integrity Checker Tool) before and after patching.
3. Import patch via admin console; allow full reboot cycle.
4. Verify version string matches vendor fixed build table.
5. Hunt for web shells under /home/webserver/ and rogue cron entries.
6. Invalidate all active VPN sessions and force password reset.

# ICT scan (run from admin UI or CLI per Ivanti docs)
# Post-patch — check for persistence
ps aux | grep -E 'wget|curl|nc |python.*-c'
crontab -l -u root 2>/dev/null

Until patched

• Disable external VPN access at perimeter firewall
• Deploy WAF/rate-limit on /dana-na/ if VPN must stay up briefly
• Monitor CISA KEV catalog for updated fixed versions