Ivanti Sentry Server-Side Request Forgery Chain (CVE-2024-21893)

CVE-2024-21893 is a server-side request forgery (SSRF) flaw in Ivanti Sentry (formerly MobileIron). Chained with other Ivanti bugs, attackers pivot from Sentry to internal Connect Secure appliances and Linux backend services.

Affected Ivanti Sentry

• Ivanti Sentry before 9.18.0.4
• Sentry 9.17.x and earlier builds
• Mobile device management gateways on port 443

Verify version

show version
curl -sk https://sentry.example.com/ | grep -i ivanti

Patching Method

1. Download Ivanti Sentry patch 9.18.0.4+ from security advisory.
2. Schedule MDM downtime — mobile enrollments pause during reboot.
3. Apply patch via Sentry admin console or vendor CLI bundle.
4. Reboot appliance; verify build in admin UI.
5. Patch linked Connect Secure / Policy Secure if in same Ivanti stack.
6. Review Sentry logs for SSRF patterns targeting internal 127.0.0.1 or RFC1918 hosts.

# Post-patch — check for lateral movement artifacts
grep -i 'ssrf\|127.0.0.1\|internal' /var/log/sentry/*.log 2>/dev/null | tail -20

Hardening

• Do not expose Sentry admin to internet
• Segment Sentry from internal database VLANs
• Enable Ivanti ICT scan after every major patch