The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging Federal Civilian Executive Branch (FCEB) agencies to take immediate action against two actively exploited zero-day flaws in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) products. These vulnerabilities, an authentication bypass (CVE-2023-46805) and a code injection bug (CVE-2024-21887), have become the target of widespread exploitation by multiple threat actors.
Description of the vulnerabilities
The authentication bypass flaw allows malicious actors to circumvent the security measures in the affected products, granting them unauthorized access. On the other hand, the code injection bug enables attackers to craft malicious requests and execute arbitrary commands on the system. This combination of flaws poses a significant threat to the security and integrity of the affected systems.
Increase in threat actor activity
After the vulnerabilities were publicly disclosed, Ivanti noticed a sharp increase in threat actor activity, with attacks intensifying from January 11, 2024. This development highlights the significance and severity of the flaws, and the urgent need for organizations to address them promptly.
Potential impact and consequences
Successful exploitation of these vulnerabilities can have severe consequences. Attackers can move laterally within the system, infiltrate data, and establish persistent access. This ultimately leads to the full compromise of target information systems, putting sensitive data, infrastructure, and even national security at risk.
Mitigations urged by CISA
CISA’s emergency directive emphasizes the need for organizations running ICS to implement the recommended mitigations immediately. Additionally, organizations are advised to use the External Integrity Checker Tool to detect any signs of compromise. If compromise is detected, disconnecting the affected devices from networks, resetting them, and importing the provided XML file are crucial steps to minimize the damage.
Additional security measures
To further enhance security, FCEB entities are urged to revoke and reissue any stored certificates. Resetting the admin enable password and securely storing API keys are essential steps in preventing further unauthorized access. It is also recommended to reset the passwords of any locally defined users on the gateway, ensuring thorough cleaning and securing of the affected systems.
Observations by cybersecurity firms
Cybersecurity firms, including Volexity and Mandiant, have reported attacks that exploit these vulnerabilities. Threat actors have leveraged the flaws to deploy web shells and passive backdoors, enabling persistent access to compromised devices. Shockingly, it is estimated that approximately 2,100 devices worldwide have already fallen victim to these attacks, underscoring the urgent need for action.
Opportunistic Exploitation for Financial Gain
Notably, GreyNoise, a threat intelligence firm, has observed bad actors exploiting these vulnerabilities for financial gain. In addition to deploying backdoors, attackers have used the flaws to drop malicious XMRig cryptocurrency miners. This opportunistic exploitation demonstrates the need for vigilance and proactive measures to safeguard against monetary incentives that drive further attacks.
The urgency to address and mitigate the zero-day flaws in Ivanti Connect Secure and Policy Secure products cannot be overstated. Organizations must act swiftly to implement the recommended mitigations and security measures to protect their systems from compromise. The collaboration between CISA, Ivanti, and cybersecurity firms highlights the seriousness of these vulnerabilities and the collective effort required to defend against them. Proactive measures and constant monitoring are indispensable in the current threat landscape, ensuring that organizations stay one step ahead of malicious actors seeking to exploit vulnerabilities for their gain.