CVE-2024-21893
HIGH KEV RANSOMWARE NUCLEIIvanti SAML - Server Side Request Forgery (SSRF)
Title source: nucleiExploitation Summary
CVE-2024-21893 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 31, 2024, with confirmed use in ransomware campaigns.
EIP tracks 3 public exploits from researchers including h4x0r-dz, Chocapikk, sfewer-r7, including a Metasploit module exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-21893, an SSRF vulnerability in Ivanti Connect Secure and Ivanti Policy Secure. The exploit crafts a malicious SOAP request with a manipulated SAML signature to trigger an external request to an attacker-controlled server, demonstrating the vulnerability.
Description
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Exploits (3)
This repository contains a functional exploit for CVE-2024-21893, an SSRF vulnerability in Ivanti Connect Secure and Ivanti Policy Secure. The exploit crafts a malicious SOAP request with a manipulated SAML signature to trigger an external request to an attacker-controlled server, demonstrating the vulnerability.
This repository contains a functional exploit for CVE-2024-21893 (SSRF) and CVE-2024-21887 (RCE) in Ivanti Connect Secure appliances. The exploit uses a crafted SOAP request to trigger SSRF and command injection, leading to unauthenticated remote code execution.
This Metasploit module chains CVE-2024-21893 (SSRF) and CVE-2024-21887 (command injection) to achieve unauthenticated RCE on Ivanti Connect Secure/Policy Secure. It exploits an SSRF in the xmltooling library to trigger a command injection in a Python backend service.
Nuclei Templates (1)
html:"welcome.cgi?p=logo" || http.title:"ivanti connect secure" || http.html:"welcome.cgi?p=logo"
body="welcome.cgi?p=logo" || title="ivanti connect secure"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N