CVE-2024-8190
HIGH KEVIvanti Cloud Services Appliance <4.6.518 - Command Injection
Title source: llmExploitation Summary
CVE-2024-8190 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 13, 2024. EIP tracks 2 public exploits from researchers including horizon3ai, flyingllama87.
AI-analyzed exploit summary This PoC exploits an authenticated command injection vulnerability in Ivanti Cloud Service Appliance by injecting a command into the TIMEZONE parameter of a POST request to /gsb/datetime.php. It requires valid credentials and a CSRF token.
Description
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
Exploits (2)
This PoC exploits an authenticated command injection vulnerability in Ivanti Cloud Service Appliance by injecting a command into the TIMEZONE parameter of a POST request to /gsb/datetime.php. It requires valid credentials and a CSRF token.
This PoC combines CVE-2024-8963 (path traversal) and CVE-2024-8190 (command injection) to achieve unauthenticated RCE on Ivanti CSA 4.6 and below. It bypasses authentication via path manipulation and injects commands into the TIMEZONE parameter.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H