Ivanti VPN Chain Exploitation: The Two-Vulnerability Knockout 🥊

Executive Summary

In early 2024, the cybersecurity community witnessed one of the most significant VPN exploitation campaigns targeting Ivanti Connect Secure and Policy Secure gateways. The vulnerability chain combining CVE-2024-21887 and CVE-2023-46805 enabled threat actors to achieve unauthenticated remote code execution, compromising thousands of devices worldwide. This sophisticated attack demonstrated how seemingly separate vulnerabilities, when chained together, can create devastating security breaches affecting critical infrastructure across multiple industries.

Understanding the Vulnerability Chain

CVE-2023-46805: The Authentication Bypass Gateway

CVE-2023-46805 represents a high-severity authentication bypass vulnerability with a CVSS score of 8.2. This flaw exists in the web component of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure gateways, affecting all supported versions including 9.x and 22.x releases.

The vulnerability allows remote attackers to bypass control checks and access restricted resources without proper authentication. The bypass mechanism leverages path traversal techniques to circumvent access control mechanisms, essentially opening a door that should remain locked to unauthenticated users. This creates the foundational step for the exploit chain, transforming what would be an authenticated-only attack into a completely unauthenticated compromise.

CVE-2024-21887: The Command Injection Powerhouse

CVE-2024-21887 carries a critical severity rating with a CVSS score of 9.1. This command injection vulnerability resides in the web components of both Ivanti Connect Secure and Policy Secure products. Under normal circumstances, this vulnerability requires authenticated administrator access to exploit, limiting its potential impact.

The vulnerability specifically affects the /api/v1/license/key-status/<path:node_name> API endpoint. An authenticated administrator can send specially crafted requests containing malicious payloads that the system executes as arbitrary commands. The restricted character set and execution environment make this particularly dangerous when combined with the authentication bypass.

The Deadly Combination: Unauthenticated RCE

When chained together, these vulnerabilities create what security researchers call a “two-vulnerability knockout punch.” The attack sequence proceeds as follows:

Initial Access: Attackers leverage CVE-2023-46805 to bypass authentication controls, gaining access to administrative functionality without credentials
Privilege Elevation: The authentication bypass provides access to endpoints normally reserved for authenticated administrators
Command Execution: Using CVE-2024-21887, attackers inject malicious commands through vulnerable API endpoints
System Compromise: Arbitrary code executes with elevated privileges, granting attackers complete control over the VPN appliance

This combination transforms two separate vulnerabilities into a single, devastating attack vector that requires no authentication, no user interaction, and provides complete system compromise.

Timeline of Discovery and Exploitation

Early December 2023: Initial Compromise

Security researchers at Volexity first detected suspicious activity on December 3, 2023, during routine network monitoring for one of their managed security clients. The investigation revealed lateral movement patterns inconsistent with normal network behavior, prompting deeper analysis that ultimately uncovered the zero-day exploitation.

January 10, 2024: Public Disclosure

Ivanti, in coordination with Volexity and Mandiant (Google Cloud’s security research division), publicly disclosed both vulnerabilities on January 10, 2024. The announcement sent shockwaves through the cybersecurity community, as the vulnerabilities affected all supported versions of widely deployed enterprise VPN solutions.

At the time of disclosure, no patches were available. Ivanti instead released a mitigation XML file through their customer portal, requiring organizations to manually import the configuration. This interim solution provided some protection but fell short of a comprehensive fix.

January 16, 2024: Mass Exploitation Begins

Following the publication of proof-of-concept exploits on January 16, 2024, security researchers observed a dramatic surge in exploitation attempts. Within the first 24 hours, scanning activity increased exponentially as threat actors worldwide sought to identify vulnerable systems before patches became available.

Patch Release Schedule

Ivanti implemented a staggered patch release schedule: - Week of January 22, 2024: First patch version released - Through February 19, 2024: Final patches for all supported versions deployed

Scale of Compromise: By the Numbers

Global Exposure Statistics

Research conducted by cybersecurity firms revealed the extensive attack surface:

Over 28,000 instances of Ivanti Connect Secure and Policy Secure were exposed to the internet across 145 countries
More than 1,700 devices confirmed compromised globally according to Volexity’s analysis
600+ cases of active exploitation observed by various security vendors
17,000+ vulnerable instances identified through Shodan searches at the peak of the campaign

Industry Impact

The compromise affected organizations across diverse sectors:

Federal Government: U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 24-01, requiring all Federal Civilian Executive Branch agencies to take immediate action
Financial Services: Multiple banking institutions reported compromise attempts
Healthcare: Hospital networks and medical facilities detected intrusion attempts
Technology Companies: Software vendors and cloud service providers found backdoors installed on their VPN appliances
Manufacturing: Industrial control system networks faced potential lateral movement threats

Threat Actor Attribution and Tactics

UNC5221: The Primary Adversary

Mandiant tracked the primary threat actor as UNC5221, a suspected China-nexus espionage group. This advanced persistent threat (APT) actor demonstrated sophisticated tradecraft including:

Custom Malware Arsenal: Deployment of multiple bespoke malware families
Anti-Forensics Techniques: Modification of Ivanti’s Integrity Checker Tool to evade detection
Persistence Mechanisms: Installation of backdoors that survived system reboots and updates
Credential Harvesting: Exfiltration of cleartext passwords and NTLM hashes from Active Directory

Malware Families Deployed

Security researchers identified several custom malware tools:

ZIPLINE: A passive backdoor that listens for specially crafted network packets, allowing attackers to establish command and control without creating obvious network connections.

LIGHTWIRE: A web shell providing persistent access to compromised systems through legitimate web server processes, making detection significantly more challenging.

WARPWIRE: A credential harvester specifically designed to extract authentication material from Ivanti’s password cache, including Active Directory credentials, API keys, and session tokens.

THINSPOOL: A dropper component responsible for deploying additional malware payloads and maintaining the infection chain.

GLASSTOKEN and GIFTEDVISITOR: Web shells that modified legitimate JavaScript components to intercept user credentials during authentication attempts.

Attack Methodology

The typical attack sequence observed by incident responders included:

Initial Exploitation: Chaining CVE-2023-46805 and CVE-2024-21887 for unauthenticated access
Database Exfiltration: Archiving /runtime/mtmp/lmdb directory containing session data, credentials, and certificates
Web Shell Installation: Backdooring legitimate CGI files like compcheck.cgi for persistent access
Log Manipulation: Disabling logging and wiping existing logs to cover tracks
Lateral Movement: Using harvested credentials to pivot into internal networks
Persistence: Modifying system files and Integrity Checker Tool to maintain access

Government Response and Emergency Directives

CISA Emergency Directive 24-01

On January 19, 2024, CISA issued Emergency Directive 24-01, one of the most urgent advisories in recent years. The directive mandated that all federal agencies:

Immediately disconnect or isolate affected Ivanti appliances
Run the external Integrity Checker Tool on all devices
Apply available mitigations before the January 22, 2024 deadline
Report any signs of compromise to CISA within 24 hours
Prepare for potential factory resets if compromise was detected

Supplemental Guidance and Updates

CISA released multiple supplemental updates as the investigation progressed:

February 29, 2024: CISA’s research team published findings revealing that the Integrity Checker Tool was insufficient for detecting sophisticated compromises. Their laboratory testing demonstrated that threat actors could maintain root-level persistence even after factory resets and appliance upgrades.

Key Research Findings: CISA researchers successfully demonstrated the full attack chain, achieving: - Domain administrator credential exfiltration in cleartext - Root-level persistence that survived security measures - Bypass of integrity check mechanisms - Internal reconnaissance using native tools

Technical Deep Dive: Exploitation Mechanics

Authentication Bypass Technical Details

The CVE-2023-46805 vulnerability exploits path traversal weaknesses in the web application’s routing logic. Certain paths in the web application remain accessible without authentication, and attackers discovered that path traversal sequences could redirect requests from these unauthenticated paths to authenticated administrative endpoints.

Example exploitation pattern:

/api/v1/totp/user-backup-code/../../license/keys-status/

This crafted URL uses the ../ traversal sequence to navigate from an unauthenticated endpoint (/api/v1/totp/user-backup-code/) to an authenticated administrative function (/license/keys-status/), effectively bypassing authentication controls.

Command Injection Technical Details

CVE-2024-21887 allows command injection through specially crafted requests to vulnerable API endpoints. The node_name parameter in the license status endpoint lacks proper input sanitization, permitting attackers to inject shell commands.

The vulnerability accepts commands within specific character constraints (periods and numbers in some variations), but sophisticated attackers found ways to execute arbitrary code despite these limitations through:

Return-Oriented Programming (ROP) chains
Unicode encoding techniques
Alternate command execution methods
Leveraging built-in system utilities

Real-World Exploit Example

Security researchers documented actual exploitation attempts showing attackers establishing reverse shells:

POST /api/v1/license/keys-status/../../malicious-path

The payload would execute commands to: - Create netcat reverse connections - Download additional tooling from attacker infrastructure - Establish Sliver implants for command and control - Execute Perl scripts to harvest cached credentials

Detection and Response Challenges

Integrity Checker Tool Limitations

Ivanti released an Integrity Checker Tool (ICT) to help customers identify compromised systems. However, multiple security firms and CISA’s own research revealed significant limitations:

Evasion Techniques: Sophisticated attackers modified the ICT itself to report false negatives
Limited Scope: The tool couldn’t detect all malware variants and persistence mechanisms
Version Specific: Different appliance versions required different detection methods
False Confidence: Organizations relying solely on ICT missed sophisticated compromises

Indicators of Compromise

Security researchers identified several IOCs for detection:

File System Modifications: - Backdoored /home/bin/compcheck.cgi - Modified /dana-na/auth/lastauthserverused.js - Suspicious files in /tmp and /runtime directories - Altered web server components in /home/webserver/htdocs/

Network Indicators: - Unusual outbound connections to attacker infrastructure - Beacon traffic patterns consistent with C2 communication - Large data transfers from credential cache locations - Suspicious SSL/TLS connections from the VPN appliance

Log Anomalies: - Disabled logging functionality - Missing or truncated log files - Gaps in authentication logs - Suspicious administrator activity outside normal hours

Mitigation Strategies and Best Practices

Immediate Actions Required

Organizations operating Ivanti Connect Secure or Policy Secure gateways must:

Patch Immediately: Upgrade to the latest patched versions (9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, or later)
Perform Factory Resets: Before applying patches, factory reset appliances as a precautionary measure to remove sophisticated persistence mechanisms
Credential Reset: Change all passwords, rotate API keys, and revoke certificates that may have been exposed
Run Detection Tools: Use both internal and external Integrity Checker Tools, but don’t rely solely on their results
Hunt for IOCs: Search for indicators of compromise in network traffic, file systems, and logs

Long-Term Security Improvements

Network Segmentation: Isolate VPN appliances from critical internal resources using zero-trust principles and micro-segmentation strategies.

Enhanced Monitoring: Implement comprehensive logging and security information and event management (SIEM) integration to detect anomalous behavior.

Multi-Factor Authentication: Enforce MFA for all VPN access and administrative functions, though recognize that CVE-2023-46805 bypassed even MFA-protected resources.

Alternative Solutions: Consider diverse VPN solutions to avoid single points of failure, or evaluate moving away from appliance-based VPNs toward cloud-native zero-trust network access solutions.

Vulnerability Management: Establish rapid patch deployment processes and maintain inventories of all internet-facing systems.

Lessons Learned and Future Implications

The Vulnerability Chain Threat Model

This incident demonstrates that vulnerability chaining represents a critical threat to modern infrastructure. Security teams must evaluate systems not just for individual vulnerabilities, but for combinations that create unexpected attack paths.

Edge Device as High-Value Targets

VPN appliances and other edge devices continue attracting sophisticated threat actors because they: - Sit at the network perimeter with access to both external and internal networks - Often run specialized operating systems with limited security tooling - May not receive the same security scrutiny as traditional servers - Provide ideal pivoting points for lateral movement

The Patch Gap Challenge

The delayed patch availability created a dangerous window where organizations knew they were vulnerable but had limited mitigation options. This scenario highlights the importance of: - Vendor transparency and rapid response - Interim mitigation strategies - Network isolation capabilities - Incident response preparedness

Nation-State Activity Acceleration

The suspected involvement of nation-state actors demonstrates that even zero-day vulnerabilities may be discovered and stockpiled by advanced adversaries long before public disclosure. Organizations must assume that sophisticated attackers already possess knowledge of unpatched vulnerabilities.

Subsequent Ivanti Vulnerabilities: A Pattern Emerges

CVE-2025-0282 and CVE-2025-0283 (January 2025)

Demonstrating a concerning pattern, Ivanti disclosed two additional critical vulnerabilities in January 2025. CVE-2025-0282, an unauthenticated stack-based buffer overflow, was actively exploited by the same UNC5221 actor beginning in mid-December 2024.

This subsequent exploitation revealed that: - Threat actors continue targeting Ivanti infrastructure aggressively - The same adversary maintains persistent interest in these products - Organizations face ongoing risk requiring constant vigilance

CVE-2025-22457 (April 2025)

In April 2025, yet another critical vulnerability emerged. CVE-2025-22457, initially assessed as unexploitable, proved vulnerable through sophisticated exploitation techniques discovered by UNC5221. This underscores the dangerous assumption that complex vulnerabilities with character constraints cannot be weaponized by determined adversaries.

Recommendations for Organizations

For Current Ivanti Customers

Maintain Vigilant Patching: Apply all security updates immediately upon release
Continuous Monitoring: Implement ²⁴⁄₇ monitoring of VPN appliances for anomalous activity
Regular Audits: Conduct frequent security audits and penetration testing
Incident Response Planning: Develop and test specific response procedures for VPN compromise scenarios
Vendor Communication: Maintain active communication channels with Ivanti support and security teams

For Security Decision Makers

Diversification Strategy: Avoid over-reliance on single vendor solutions for critical infrastructure
Zero-Trust Architecture: Implement zero-trust principles that assume breach and verify continuously
Risk Assessment: Regularly evaluate the security posture of all internet-facing systems
Threat Intelligence: Subscribe to threat intelligence feeds specific to infrastructure vendors
Tabletop Exercises: Conduct regular exercises simulating compromise of edge devices

For Security Researchers

Responsible Disclosure: Continue coordinating with vendors while ensuring public awareness
Tool Development: Create and share detection tools and IOCs with the security community
Research Publication: Document technical details to advance collective knowledge
Collaboration: Work with other researchers to identify vulnerability chains before attackers

Conclusion

The CVE-2024-21887 and CVE-2023-46805 vulnerability chain represents a watershed moment in enterprise security. The compromise of thousands of VPN appliances across global organizations demonstrates that even well-defended networks remain vulnerable to sophisticated, multi-stage attacks.

The incident reinforces several critical security principles:

Defense in Depth Remains Essential: No single security control prevented this attack. Organizations that detected compromise typically had multiple layers of monitoring and detection.

Patch Management is Non-Negotiable: The window between disclosure and patching created the greatest risk. Organizations with rapid patch deployment processes minimized their exposure.

Threat Intelligence Drives Readiness: Organizations tracking UNC5221 and similar threat actors were better prepared to recognize and respond to compromise indicators.

Edge Device Security Requires Priority: VPN appliances and similar edge infrastructure deserve the same security investment as traditional data center systems.

As we progress through 2025, the pattern of sophisticated attacks against edge infrastructure continues. The evolution of threats from CVE-2024-21887/CVE-2023-46805 through CVE-2025-0282 and CVE-2025-22457 demonstrates that organizations must maintain constant vigilance, rapid response capabilities, and diverse security strategies.

The two-vulnerability knockout punch delivered by this exploit chain serves as a stark reminder that modern cyber threats require modern defensive postures. Organizations that treat security as a continuous process rather than a point-in-time implementation will best weather the storm of sophisticated, persistent attacks targeting the critical infrastructure that connects us all.

Additional Resources

CISA Advisory AA24-060B: Comprehensive guidance on threat actor exploitation of Ivanti vulnerabilities
Ivanti Security Advisories: Official vendor notifications and patch information
Volexity Blog: Original disclosure and technical analysis
Mandiant Intelligence: Detailed threat actor attribution and IOC sharing
Tenable Research: Vulnerability scanning plugins and detection methods

Last Updated: December 2024