Exploitation Summary
CVE-2024-22024 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including 0dteam, cybersecplayground. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python script that exploits CVE-2024-22024, an XXE vulnerability in Ivanti Connect Secure. The script sends a crafted SAML request with an XXE payload to trigger an out-of-band interaction with an attacker-controlled URL.
Description
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
Exploits (2)
This repository contains a functional Python script that exploits CVE-2024-22024, an XXE vulnerability in Ivanti Connect Secure. The script sends a crafted SAML request with an XXE payload to trigger an out-of-band interaction with an attacker-controlled URL.
The repository contains detailed technical writeups for multiple CVEs, including CVE-2024-22024, which involves an XXE vulnerability in Ivanti Connect Secure via SAMLRequest injection. The writeups include vulnerability descriptions, proof-of-concept details, and mitigation recommendations.
Nuclei Templates (1)
html:"welcome.cgi?p=logo" || http.title:"ivanti connect secure" || http.html:"welcome.cgi?p=logo"
body="welcome.cgi?p=logo" || title="ivanti connect secure"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L