seajaysec/ivanti-connect-around-scanMitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.
The Connect Around attack chain, involving CVE-2023-46805 and CVE-2024-21887, poses a significant threat to Ivanti Connect Secure & Policy Secure appliances. This attack chain enables unauthorized access and command execution on vulnerable systems. CVE-2023-46805 allows attackers to bypass authentication controls, while CVE-2024-21887, a command injection vulnerability, can be exploited without needing authentication when combined with the former. This duo of vulnerabilities necessitates urgent attention from organizations using Ivanti products, urging them to apply available mitigations as detailed in the Ivanti Community Forum.
In response to the need for organizations to validate mitigation status, the Ivanti Connect Around Vulnerability Checker has been developed. This script is designed to assess Ivanti Connect Secure & Policy Secure appliances for vulnerabilities associated with the Connect Around attack chain. It performs checks to verify the presence of these vulnerabilities and outputs the results in a CSV format. Multiple mitigation validation methodologies are employed to provide a comprehensive and reliable assessment.
Note: This script does not validate CVE-2024-21888 or CVE-2024-21893.
The script conducts various checks to assess the security status of Ivanti Connect Secure systems. Each check is based on specific methodologies adapted from research within the information security community.
/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint without authentication./api/v1/system/system-information URI./admin/options/ URI.Each check provides insights into potential vulnerabilities. "Vulnerable" indicates a confirmed vulnerability, while "Mitigated" or "Not Vulnerable" signifies that the system appears secure against the specific vulnerability being tested.
The script categorizes each check with specific status types, providing insight into the security posture of the scanned host. Here are the descriptions of each status type:
Mitigated: Indicates that the system has mitigations in place against the vulnerabilities checked. This status is returned when responses typical of a secure and patched system are detected.
Vulnerable: This status suggests that the system is vulnerable to the specific checks performed by the script. It is returned when the system exhibits known patterns or responses that indicate a vulnerability.
HTTP Error: Returned when the script encounters standard HTTP error responses (other than 403 Forbidden) from the target system. It usually indicates a problem with the web server or the request.
Network Issue: This status is used when the script encounters network-related issues, such as an inability to reach the host. It combines former statuses like "Host Unreachable" and "Network Error."
Timeout Error: Indicates that the request to the target timed out, suggesting potential network or configuration issues that prevented the script from completing its check.
Connection Error: Similar to "Timeout Error," this status is used when there are issues establishing a connection to the host, which could be due to network problems, incorrect hostnames, etc.
Ivanti Presence Inconclusive: Formerly known as "Attestation Needed," this status is returned when the script's checks do not yield definitive evidence of either vulnerability or mitigation. It suggests that further manual investigation is required to determine the security status of the system.
Vulnerable (Bypass Detected): Specific to the bypass vulnerability check, this status indicates that the system is vulnerable to the authentication bypass technique described in the script's methodology.
Each status provides a snapshot of the system's security posture concerning the vulnerabilities checked. Users should consider these statuses as initial indicators and, where necessary, conduct further manual investigations to confirm the system's actual security status.