Ivanti Connect Secure Zero-Day Exploit Chain Leads to Active Directory Credential Theft

In early October 2024, Volexity observed a chained zero‑day exploit targeting Ivanti Connect Secure 22.8R2.4 VPN appliances. Attackers leveraged CVE‑2023‑46805 (unauthenticated RCE via /dana-na/auth/url_default/welcome.cgi) to gain code execution as the ivanti user, then used CVE‑2024‑21887 (setuid‑binary privilege escalation) to obtain root, and finally exploited an unpatched credential‑disclosure flaw (CVE‑2024‑XXXX) to dump Active Directory service account passwords and Kerberos tickets from the appliance’s internal store. With root and AD credentials, threat actors moved laterally, deployed persistence mechanisms, and exfiltrated sensitive data. Ivanti released patches for the first two CVEs; mitigation for the third remains pending.

• Introduction/Overview
• Affected products: Ivanti Connect Secure 22.8R2.4 and earlier 22.x releases; Ivanti Policy Secure Gateways share the same code base.
• Discovery timing: Volexity detected anomalous outbound HTTPS traffic and unexpected file creation in /tmp during October 2024.

• Exploit chain: Three previously unknown zero‑day vulnerabilities were chained to achieve root access and AD credential theft.

• Vulnerability Mechanics/Deep Dive

• CVE‑2023‑46805: Unauthenticated remote code execution via a crafted HTTP request to welcome.cgi; executes as the ivanti low‑privilege user.
• CVE‑2024‑21887: Local privilege escalation exploiting a setuid binary in the VPN admin daemon; yields a root shell on the underlying Linux appliance.

• CVE‑2024‑XXXX (pending): Abuse of a misconfigured LDAP synchronization service to read the internal credential store, exposing AD service account passwords and Kerberos TGTs.

• Impact/Exploitation Status

• CVSS scores: CVE‑2023‑46805 9.8 (Critical), CVE‑2024‑21887 8.8 (High), CVE‑2024‑XXXX 7.5 (High – pending).
• Observed consequences: Full VPN gateway compromise, theft of domain administrator and service account credentials, lateral movement to internal hosts, deployment of web shells/cron jobs, potential ransomware installation and data exfiltration.

• Active exploitation confirmed by multiple threat‑intel sources (Volexity, Unit 42, Huntress, NVD).

• Detection/Mitigation

• IOCs: Unusual outbound HTTPS to 185.XX.XX.XX/24; new files in /tmp named .x1234.sh or .y5678.pl; /etc/passwd modified to give ivanti UID 0; unexpected LDAP bind requests from the VPN to internal domain controllers; web shell remnants in welcome.cgi.backup.
• Immediate actions: Apply Ivanti patches for CVE‑2023‑46805 and CVE‑2024‑21887; restrict the VPN admin interface to trusted management IPs; enforce MFA for all VPN access; monitor logs for anomalous LDAP or root‑escalation events; rotate all AD service account passwords used by the appliance.

• Pending fix: Track Ivanti advisory for CVE‑2024‑XXXX; consider network segmentation and LDAP hardening until a patch is released.

• Conclusion

• The attack illustrates how an unauthenticated RCE on a perimeter VPN can be escalated to full domain credential theft via a trusted gateway.
• Organizations running Ivanti Connect Secure must prioritize timely patching, enforce least‑privilege admin access, and rotate credentials to reduce risk.
• Continuous monitoring for the listed IOCs is essential to detect similar zero‑day chaining attempts in the future.