CVE-2024-22024: New High-severity Ivanti Authentication Bypass Vulnerability

On 8 February 2024, Ivanti publicly disclosed a high-severity authentication bypass vulnerability (CVE-2024-22024) impacting Ivanti Connect Secure, Policy Secure, and ZTA products. CVE-2024-22024 is an XML external entity (XXE) flaw in the SAML component and could allow threat actors to bypass authentication and access certain restricted resources if successfully exploited. 

This vulnerability was initially discovered and responsibly disclosed by WatchTowr Labs. Arctic Wolf has not observed a publicly available proof of concept (PoC) exploit published for this vulnerability. Additionally, we have not observed active exploitation at this time. However, based on the historical targeting of recent vulnerabilities in Ivanti products, including CVE-2024-21893, CVE-2024-21887, and CVE-2023-46805, and the potential to bypass authentication, we assess threat actors will likely develop a working PoC exploit and attempt exploitation of this vulnerability in the near term. 

Recommendation for CVE-2024-22024

Upgrade Ivanti Products to Fixed Version

Arctic Wolf strongly recommends upgrading vulnerable Ivanti products to the latest released versions. 

Organisations that have applied the patch released on 31 January or 1 February and completed a factory reset of their appliance, do not need to factory reset their appliances again, according to Ivanti. 

References

1. Ivanti Article
2. WatchTowr Labs Responsible Disclosure 
3. Arctic Wolf Blog (CVE-2024-21887 & CVE-2023-46805)
4. Volexity Blog 1 
5. Volexity Blog 2

See other important security bulletins from Arctic Wolf.