Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887): a VPN chain exploited before patches existed

Publicly disclosed: 10 January 2024

On 10 January 2024 Ivanti disclosed two vulnerabilities in its Connect Secure (formerly Pulse Secure) VPN and Policy Secure gateways that were already exploited as zero-days. An authentication bypass combined with a command injection let unauthenticated attackers run commands on the appliance. Patches arrived only weeks later, so a temporary configuration mitigation was the first defence. CISA issued an emergency directive.

Lessons

• Attackers modified the appliances and, in some cases, tried to survive updates. Ivanti and CISA recommended a factory reset before applying patches on affected devices, and resetting passwords, keys and certificates stored on them.
• The built-in integrity checker could be misled; external checks and log analysis were needed.

How to protect remote-access appliances

1. Apply vendor mitigations the same day when patches are not yet available.
2. Send logs off the device so they cannot be wiped.
3. After a compromise, rebuild — do not just patch.
4. Plan to replace appliances that repeatedly need emergency fixes.

When the gate itself is compromised, you rebuild the gate — you do not paint over it.

Sources: CISA ED 24-01, NVD CVE-2024-21887.

Need help with this? Contact CySec for a free consultation.

All articles