Ivanti VPN Vulnerability: Mitigation Strategies, Incident Response, and Defense
Chinese state-sponsored hackers have targeted recently announced vulnerabilities in Ivanti VPN products, Ivanti Connect Secure (formerly Pulse Secure) and Ivanti Policy Secure gateways. These vulnerabilities are reported as CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893.
When used together, these vulnerabilities may allow unauthorized authentication bypass and remote command execution. Ivanti has released patches for these vulnerabilities for the most used versions of their products, but the company has not yet released patches for all vulnerable versions of its products. This leads to a heightened risk of privilege escalation and server-side request forgery for those who are not yet able to apply a patch.
Ivanti Security Measures and Recommendations
Unit 42® advises immediate patch application for these vulnerabilities as it’s made available and a proactive stance on system resets before patching to ensure environmental integrity. In response to the newly discovered vulnerabilities, we echo CISA's recommendation for network disconnection of compromised solutions and stress the importance of applying available or forthcoming patches diligently.
In the latest segment of the Threat Vector podcast, Unit 42 cybersecurity experts Sam Rubin, VP and Global Head of Operations, and Ingrid Parker, Senior Manager of the Intel Response Unit, dive deep into the critical vulnerabilities found in Ivanti’s Connect Secure and Policy Security Products. They explore the vulnerabilities’ potential impact, the urgency of mitigation, and strategies for defense.
Unit 42 Incident Response Cases
The exploitation campaigns of the CVE-2023-46805 and CVE-2024-21887 Ivanti vulnerabilities occurred in three distinct waves.
The first wave lasted from at least the second week of December 2023 to Jan. 10, 2024, when Volexity published their first blog post on the matter. The attacks in this campaign were targeted and featured multiple custom web shells and lateral movement. Unit 42 responded to threat activity that likely corresponded to this wave of campaigns.
Similar to the activity discussed in Volexity’s blog post, we observed the threat actor performing the following activities:
- Archiving files including NTDS.dit using 7-Zip before exfiltration
- Creating a memory dump of the LSASS process using Windows Task Manager (Taskmgr.exe)
- Moving laterally via remote desktop protocol (RDP)
- Deleting logs
The second wave began after Volexity’s first blog post on Jan. 10, 2024. This wave was marked by a shift from targeted attacks to mass exploitation by additional threat actors.
Unit 42 responded to cases of threat activity that likely corresponded to this wave of campaigns. The threat activity was consistent across these cases.
The threat actor dumped configuration data containing schema, settings, names and credentials of the various users and accounts within the network, but did not perform any lateral movements like the incidents that occurred in the first wave.
Unit 42 believes that the threat actors behind this activity might have shifted focus to wider exploitation to maximize impact before organizations could begin patching and applying mitigation guidance.
The third wave began as early as Jan. 16, 2024, when proof-of-concept (PoC) exploits became publicly available. The release of these exploits lead to mass exploitation by a range of actors with various motivations and degrees of sophistication, including criminal entities widely deploying cryptominers and various remote monitoring and management (RMM) software.
Unit 42 has responded to threat activity that likely corresponded to this wave, from a threat actor using a publicly available PoC exploit. We are currently supporting our clients investigating those incidents.
Comprehensive Ivanati Defense Strategies
The discovery of these vulnerabilities underscores the need for vigilant security measures and rapid response capabilities. This has highlighted critical security vulnerabilities within widely used virtual private network (VPN) technologies exploited by sophisticated threat actors. These vulnerabilities allow unauthorized access and control, posing significant risks to organizational networks.
The following strategies are critical for maintaining a strong security posture against evolving cyberthreats, ensuring the protection of sensitive information and critical infrastructure:
- Inventory your assets: Catalog all network devices, systems and software.
- Choose the right tools: Utilize vulnerability scanning tools that best fit your IT environment's complexity and scale.
- Scan for vulnerabilities: Regularly run scans to identify security weaknesses in your systems.
- Analyze the results: Carefully review scan results to prioritize vulnerabilities based on their severity and potential impact.
- Remediate and patch: Apply necessary patches or workarounds to mitigate identified vulnerabilities.
- Repeat and review: Monitor and reassess your security posture to adapt to new threats.
Be sure to check our advanced Ivanti Emerging Threat Report:
Adopting a Comprehensive Cybersecurity Strategy
Taking significant measures to protect your network from potential cyberthreats is essential. Some methods to safeguard your network include hiding applications and VPNs from public internet visibility to shield them from attackers. You should also thoroughly inspect all inbound and outbound traffic to neutralize threats such as malware and zero-day exploits.
Applying the principle of least privilege across your network is another vital step. This ensures that users can only access resources necessary for their roles. You should also strengthen access controls by using robust multifactor authentication to verify user identities effectively.
Connecting users directly to applications rather than the broader network is also recommended. This minimizes potential damage from security incidents. Utilizing continuous monitoring is also essential to identify and mitigate threats posed by compromised insiders or external actors.
To protect sensitive data, diligent monitoring and encryption should be applied both in transit and at rest. Employing deception technologies and proactive threat hunting can help identify and neutralize threats before they can cause harm.
Fostering a culture of security awareness within your organization can also defend against common vectors like phishing. Regularly evaluating your security measures through assessments and simulations can help identify and address vulnerabilities.
Palo Alto Networks Zero Trust Approach
In response to these threats, Palo Alto Networks emphasizes the criticality of a Zero Trust architecture, providing secure, segmented access to applications without exposing them to direct internet threats. Our solutions, including advanced threat prevention and segmentation policies, are designed to minimize the attack surface, prevent unauthorized access, and detect and respond to threats in real-time.
