ET EXPLOIT Ivanti Connect Secure (9.x,22.x) / Ivanti Policy Secure (9.x,22.x) / Ivanti Neurons for ZTA Command Injection via SSRF (CVE-2024-21887)

SID: 2050700Rev: 243 viewsHistory

Sourceet/open

CreatedFebruary 2, 2024

UpdatedNovember 22, 2024

Classificationattempted-admin

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Ivanti Connect Secure (9.x,22.x) / Ivanti Policy Secure (9.x,22.x) / Ivanti Neurons for ZTA Command Injection via SSRF (CVE-2024-21887)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/dana-ws/"; fast_pattern; content:".ws"; http.request_body; content:"<soap|3a|"; content:"|3a|RetrievalMethod|20|URI=|22|"; distance:0; pcre:"/^[^\x22]+(?:\x3b|%3[Bb])/R"; reference:url,attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis; reference:cve,2024-21887; classtype:attempted-admin; sid:2050700; rev:2; metadata:affected_product Ivanti, attack_target Server, created_at 2024_02_02, cve CVE_2024_21887, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_11_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

References

url	attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis
cve	2024-21887

Metadata

affected productIvanti

attack targetServer

created at2024_02_02

cveCVE-2024-21887

deploymentInternal

confidenceHigh

signature severityMajor

tagCISA_KEV

updated at2024_11_22

mitre tactic idTA0001

mitre tactic nameInitial_Access

mitre technique idT1190

mitre technique nameExploit_Public_Facing_Application

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!