Exploitation Summary
CVE-2023-36661 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit from researchers including sfewer-r7, including a Metasploit module exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.
AI-analyzed exploit summary This Metasploit module chains an SSRF vulnerability (CVE-2024-21893/CVE-2023-36661) with a command injection vulnerability (CVE-2024-21887) to achieve unauthenticated remote code execution on Ivanti Connect Secure and Ivanti Policy Secure. It exploits a misconfigured XML signature retrieval mechanism to trigger an internal SSRF, which then executes arbitrary commands via a vulnerable backend service.
Description
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
Exploits (1)
This Metasploit module chains an SSRF vulnerability (CVE-2024-21893/CVE-2023-36661) with a command injection vulnerability (CVE-2024-21887) to achieve unauthenticated remote code execution on Ivanti Connect Secure and Ivanti Policy Secure. It exploits a misconfigured XML signature retrieval mechanism to trigger an internal SSRF, which then executes arbitrary commands via a vulnerable backend service.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H