CVE DatabaseCVE-2024-21887

Updated 2026-08-04한국어 권고문 →

CVE-2024-218879.1/CRITICALCISA KEVCWE-77CWE-77

Ivanti Connect Secure and Policy Secure Remote Command Injection Vulnerability (CVE-2024-21887) Security Advisory

⚡ Jump to Patch

Affected Vendors

ivanti

Affected Components

connect secure, policy secure

Published Date

2024-01-12

CVSS v3.1

9.1

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) gateway appliances

Impact

An authenticated administrator can send specially crafted HTTP requests to execute arbitrary OS commands with root privileges, leading to full appliance compromise

Mitigation

Apply the official vendor security patches immediately, or import the temporary mitigation XML file provided by Ivanti to block vulnerable API endpoints

Affected Products & Version Scope

Ivanti Connect Secure (versions 9.x and 22.x), Ivanti Policy Secure (versions 9.x and 22.x)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Immediately upgrade your Ivanti appliances to the latest patched versions via the Ivanti licensing and download portal. For clustered environments, apply the patches sequentially starting with the active nodes.

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, download and import the official mitigation XML file ('mitigation.release.20240107.1.xml') from the Ivanti portal to block access to the vulnerable API endpoints. Additionally, restrict administrative access to trusted networks only.

bash

# [Note] The following commands restrict access to the management interface (e.g., port 8443) to trusted IP ranges only.
# Apply these rules on your perimeter firewall or local iptables if applicable.

# Allow management access only from a trusted administration subnet
iptables -A INPUT -p tcp -s 10.10.10.0/24 --dport 8443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP

3. Log Audit & IoC Verification Commands

Run the built-in Integrity Checker Tool (ICT) and inspect web server logs for indicators of compromise (IoCs).

bash

# 1. Search web server access logs for suspicious command injection patterns in API endpoints
grep -Ei '/api/v1/configuration/|/api/v1/system/' /var/log/web_server_access.log | grep -E '(\||;|\&|\`|\$)'

# 2. Run the built-in Integrity Checker Tool (ICT) to detect modified or newly created system files
# Execute this command via the appliance console to verify system integrity
/home/bin/integrity_check -v

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

This vulnerability is actively exploited in the wild; immediately apply the official vendor patches or import the Ivanti mitigation XML to secure your gateways.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-21887) is an OS command injection vulnerability (CWE-77) residing in the web components of Ivanti Connect Secure and Ivanti Policy Secure. The root cause is the lack of proper input validation and sanitization of user-supplied parameters before passing them to system shell execution functions within the web management interface. While it theoretically requires administrative privileges, it can be chained with the authentication bypass vulnerability (CVE-2023-46805) to allow unauthenticated remote code execution (RCE).

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending a crafted HTTP request (such as POST or GET) containing shell metacharacters (e.g., ';', '&', '`', or '$()') to vulnerable API endpoints. The backend script processes this input and executes the injected commands under root privileges. In active wild campaigns, threat actors chain this with CVE-2023-46805 to bypass authentication, trigger the command injection, drop web shells, and establish persistent access to the appliance.

3. Infrastructure & Business Impact

Ivanti gateways serve as critical entry points for corporate networks, managing SSL-VPN and Zero Trust Network Access (ZTNA). A successful compromise of this appliance grants the attacker root-level access, enabling them to bypass perimeter defenses, perform lateral movement, harvest credentials, and deploy ransomware or malware across the internal network. Given that this vulnerability is actively exploited in the wild (listed in CISA KEV), it poses an immediate and severe threat to enterprise infrastructure.

Official Vendor Advisories & References

NVD Original English Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html

Source: support@hackerone.com · Exploit, Third Party Advisory, VDB Entry

https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Source: support@hackerone.com · Vendor Advisory

http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2024-21887)

FAQ

Q1. How critical is CVE-2024-21887 and is it actively exploited in the wild?

CVE-2024-21887 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2024-21887?

Primary impacted vendors include ivanti across connect secure, policy secure. Scope summary: Ivanti Connect Secure (versions 9.x and 22.x), Ivanti Policy Secure (versions 9.x and 22.x)

Q3. What temporary mitigations or workarounds exist for CVE-2024-21887 before patching?

[Mitigation] Apply the official vendor security patches immediately, or import the temporary mitigation XML file provided by Ivanti to block vulnerable API endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION