CVE-2024-13843
📋 TL;DR
This vulnerability allows local authenticated administrators on Ivanti Connect Secure and Policy Secure systems to read sensitive data stored in cleartext. It affects organizations using these Ivanti products before specific patched versions. The risk is limited to users with administrative access to the affected systems.
💻 Affected Systems
- Ivanti Connect Secure
- Ivanti Policy Secure
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator credentials or other sensitive authentication data could be extracted, potentially leading to lateral movement or privilege escalation within the network.
Likely Case
Local administrators could access configuration files containing passwords, API keys, or other sensitive information stored without encryption.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized administrators who should already have access to sensitive system data.
🎯 Exploit Status
Exploitation requires existing admin-level access to the system, making this primarily an insider threat or post-compromise issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Connect Secure 22.7R2.6 or later, Policy Secure 22.7R1.3 or later
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Ivanti support portal. 2. Backup current configuration. 3. Apply patch via web admin interface or CLI. 4. Reboot the appliance. 5. Verify successful update.
🔧 Temporary Workarounds
Restrict administrative access
allLimit the number of users with administrative privileges and implement strict access controls.
Implement monitoring and auditing
allEnable detailed logging of administrative actions and regularly review access logs.
🧯 If You Can't Patch
- Implement strict principle of least privilege for administrative accounts
- Enable comprehensive logging and monitoring of all administrative access to affected systems
🔍 How to Verify
Check if Vulnerable:
Check the appliance version via web admin interface (System > Maintenance > Version) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify version is at least Connect Secure 22.7R2.6 or Policy Secure 22.7R1.3, then check that sensitive data files are no longer stored in cleartext📡 Detection & Monitoring
Log Indicators:
- Unusual administrative access patterns
- Access to sensitive configuration files by administrators
- Failed attempts to access protected files
Network Indicators:
- Unusual administrative SSH or web console connections
- Data exfiltration from administrative interfaces
SIEM Query:
source="ivanti*" AND (event_type="file_access" OR user_role="admin") AND (file_path="*config*" OR file_path="*password*")