iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Ivanti VPN incident was not one vulnerability but a chain: CVE-2023-46805 bypassed authentication, and CVE-2024-21887 turned that unauthenticated access into command execution. Together, they allowed an internet-based attacker to run commands on vulnerable Ivanti Connect Secure or Ivanti Policy Secure gateways without valid credentials. Attackers then deployed web shells, accessed credentials, surveyed networks and pursued persistence.
This explanation covers how the chain worked, which products and dates were involved, how CVE-2024-21893 changed the response picture, and how to investigate an appliance that may have been compromised.
The two vulnerabilities that formed the chain
Each CVE removed a different security barrier. The first exposed restricted functionality; the second supplied the ability to execute an attacker’s instructions.
Free tools Windows power users keep installed
One-click scans. No signup required.
CVE-2023-46805: authentication bypass
CVE-2023-46805 was an authentication-bypass vulnerability. An attacker could reach functions that should have required a valid login, despite having no legitimate account. On an appliance reachable from the internet, that changed the problem from “can someone obtain credentials?” to “can someone send a request to the gateway?”
#1 Best Overall
CVE-2024-21887: command injection
CVE-2024-21887 was a command-injection vulnerability. By sending a specially crafted request, an attacker could cause the gateway to execute operating-system commands. Command injection is especially serious on a security appliance because the device sits at a network boundary and commonly handles authentication, remote access and configuration data.
Why using them together mattered
The authentication bypass supplied the entry point and the command injection supplied execution. Chained in that order, the flaws enabled unauthenticated remote code execution: an attacker could take control of an affected gateway without first signing in. CISA described both vulnerabilities as actively exploited and warned that they could allow control of an affected system. The affected products were Ivanti Connect Secure and Ivanti Policy Secure gateways in the 9.x and 22.x branches covered by the advisories.
| Stage | Security barrier removed | Practical result |
|---|---|---|
| 1. Reach the appliance | Internet exposure of a VPN gateway | The attacker can send requests to the device’s web-facing service. |
| 2. Bypass authentication | CVE-2023-46805 | Restricted functionality becomes reachable without valid credentials. |
| 3. Inject a command | CVE-2024-21887 | The appliance processes attacker-controlled input as an operating-system command. |
| 4. Establish control | Successful command execution | The attacker can install tools, alter files, collect information or prepare further access. |
What an attacker could do after execution
Remote code execution was the turning point, not the end of the operation. A joint government advisory and Volexity reporting described activity that continued through several phases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Deploy a web shell
Attackers installed web shells so they could issue commands through the appliance’s web service after the original exploit request. Reported variants included GLASSTOKEN and GIFTEDVISITOR. A web shell can provide a quieter, repeatable access path than repeatedly sending the original exploit chain.
Access credentials
The gateway may contain user, administrator or service-account material used to operate remote access and connect to other systems. The allied advisory tells defenders to assume credentials stored within affected Ivanti appliances are likely compromised. That assumption applies even when the organization has not yet proven that a particular password was copied.
Reconnoiter and move laterally
Once inside the appliance, an operator can learn about connected networks, accounts and services, then use obtained credentials or other information to investigate downstream systems. The reports describe reconnaissance and lateral movement as part of the observed activity. The VPN appliance therefore has to be treated as a potential launch point into the wider environment, not as an isolated box.
Maintain persistence
Attackers can modify files or add components that survive ordinary administrative actions. This is why a successful patch or a factory reset is not, by itself, proof that an intruder has been removed. Persistence must be evaluated with integrity checking, file review and independent threat hunting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where CVE-2024-21893 fits
CVE-2024-21893 was a separate server-side request-forgery (SSRF) vulnerability in the SAML component. SSRF can make a server send requests to resources that are not directly exposed to an outside user. In this incident family, it expanded the attack surface and appeared in later remediation guidance.
Rank #3
It should not be described as one of the two flaws that created the original authentication-bypass-plus-command-injection chain. Instead, treat it as an additional issue requiring the relevant vendor update or mitigation and include it when reviewing the appliance’s exposure and activity.
Timeline: discovery, disclosure and remediation
| Date | What happened | Why it matters |
|---|---|---|
| Early December 2023 | Volexity said it observed exploitation by the actor it tracked as UTA0178. | Exploitation was underway before public disclosure. |
| January 10, 2024 | Volexity publicly reported the chained vulnerabilities, and CISA issued its alert. | Organizations received public confirmation that the flaws were being used in attacks. |
| January 31, 2024 | Ivanti listed patch releases for the four critical CVEs disclosed in the January sequence. | Patch availability changed the response options for supported branches. |
| March 1, 2024 | A joint advisory consolidated technical findings, indicators and defensive guidance. | Defenders gained broader hunting and recovery direction. |
The dates do not establish how many organizations were compromised. No authoritative source cited here provides a single victim count, prevalence percentage or universal exposure rate.
How to determine whether an appliance was compromised
Use several lines of evidence. A clean result from one check cannot establish that the gateway was never accessed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute1. Identify the exact appliance and branch
- Record whether the device is Ivanti Connect Secure or Ivanti Policy Secure.
- Record its software branch, including whether it is in the 9.x or 22.x family covered by the advisories.
- Document internet exposure, administrative interfaces, maintenance windows and any high-availability peers.
- Preserve relevant logs and configuration data before making changes that could destroy evidence.
2. Apply current vendor guidance
Install Ivanti’s current supported patch or follow the current mitigation guidance for the affected branch. “Mitigated” and “patched” are not interchangeable: a mitigation can reduce immediate exposure while the underlying software remains vulnerable, whereas the vendor update is the durable corrective action when available.
3. Run the external Integrity Checker Tool
Run the latest external Integrity Checker Tool (ICT) supplied by Ivanti. The advisory guidance specifically calls for the most recent external ICT, rather than relying only on checks performed from inside a potentially altered appliance. Review the output for modified, unexpected or otherwise suspicious files and retain the results as part of the incident record.
4. Hunt for web shells and indicators
Use the indicators of compromise and detection methods in the CISA, joint government and Volexity reports. Look for evidence of GLASSTOKEN or GIFTEDVISITOR activity, unexpected web-accessible files, unusual requests, unexplained administrative changes and outbound connections that do not match normal gateway operation. Correlate appliance events with identity, endpoint, firewall, DNS and cloud logs so a command issued on the gateway can be compared with activity that followed elsewhere.
5. Examine downstream activity
Review authentication and administrative logs for the period beginning with the earliest credible exposure, including the early-December exploitation window reported by Volexity. Investigate unusual use of accounts that authenticated through or were stored on the gateway, new access from the gateway’s network location, and lateral movement into servers, directory services or management systems.
What to do after suspected or confirmed compromise
- Contain the gateway. Follow the organization’s incident-response plan to limit unnecessary administrative and network access while preserving evidence. Avoid actions that erase logs or modified files before they are collected.
- Patch or mitigate the appliance. Use the current Ivanti instructions for the installed branch. If the device cannot be updated promptly, apply the current mitigation and treat it as temporary exposure reduction, not closure.
- Rotate credentials. Assume user and service-account credentials stored on the appliance may be compromised. Reset them from a trusted system, prioritize privileged and service accounts, invalidate active sessions or tokens where supported, and update secrets in dependent applications.
- Investigate connected systems. Hunt across identity providers, directory services, endpoints, servers, firewalls and remote-access tooling for activity associated with the appliance or its accounts.
- Assess persistence before rebuilding. If integrity checks or threat hunting indicate tampering, follow the latest vendor and government recovery procedure. A factory reset alone is insufficient evidence of eradication when persistence or downstream compromise is possible.
- Document decisions and verify recovery. Keep ICT results, patch versions, credential-rotation times, affected accounts, collected logs and validation results. After restoration, monitor for renewed web-shell, authentication or outbound-connection activity.
Choosing between mitigation, patching and rebuild actions
There is no single response action that answers every risk. Compare the choices against the same operational questions.
Best Value
| Response choice | Exposure reduction speed | Compromise-detection confidence | Credential and network impact | Persistence risk | Operational effect |
|---|---|---|---|---|---|
| Vendor mitigation | Usually the fastest way to reduce exposure when a patch cannot be installed immediately. | Does not prove the appliance was clean before mitigation; pair it with ICT and hunting. | Does not remove already exposed credentials; rotate them when compromise is possible. | Existing web shells or file changes may remain. | Often less disruptive than replacement, but depends on the guidance and configuration. |
| Vendor patch | Removes the addressed software defects when correctly installed. | Still does not establish that exploitation did not occur earlier. | Previously stored credentials may remain at risk and require rotation. | Patch installation alone may not remove attacker modifications. | Requires a maintenance window and a verified supported version. |
| Rebuild or factory reset with investigation | Can provide a clean platform when performed under the recovery guidance. | Highest confidence when combined with preserved evidence, ICT findings and independent hunting. | Requires broad credential and downstream-system review. | Addresses appliance persistence more directly, but cannot undo compromise elsewhere. | Most disruptive; plan alternate remote access and staged restoration. |
The allied advisory’s practical order is consistent across these choices: assume stored credentials are compromised, hunt using the published indicators, run the latest external ICT and apply Ivanti’s available update guidance as versions become available.
Common mistakes that leave organizations exposed
- Stopping at the patch. A patch closes the software defect; it does not tell you whether an attacker used it earlier.
- Trusting a normal login screen. The first flaw specifically bypassed authentication, so an absence of suspicious logins is not proof that the appliance was not accessed.
- Resetting only VPN passwords. Service accounts, administrator credentials, tokens and secrets stored on the appliance can affect systems beyond the VPN itself.
- Using only an internal check. An appliance that has been altered may not reliably report its own state. Use the latest external ICT and independent log correlation.
- Treating a factory reset as a complete incident response. Rebuilding the gateway does not investigate copied credentials, lateral movement or persistence on other systems.
- Assuming CVE-2024-21893 is the same bug. The SSRF flaw is separate, but it belongs in the same exposure review and remediation plan.
What “fixed” should mean for this incident
An organization should consider the incident addressed only after it has reduced appliance exposure with current vendor guidance, checked integrity with the external ICT, hunted for the published web-shell and other indicators, rotated potentially exposed credentials, and investigated downstream systems. The exact rebuild decision depends on evidence, business continuity requirements and the current Ivanti and government recovery instructions.
The central lesson is simple: CVE-2023-46805 opened the restricted door, CVE-2024-21887 let the attacker issue commands, and the resulting access could extend beyond the gateway. Effective recovery therefore combines software remediation with evidence-based investigation and credential containment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
