Horizon Alert
Summary of the vulnerability and why it matters
The web component of Ivanti Connect Secure and Ivanti Policy Secure is vulnerable. This flaw allows unauthorized access to restricted resources by bypassing control checks. Successful exploitation could enable attackers to gain administrative access, potentially leading to data exfiltration, ransomware deployment, or espionage within an organization's network.
- Vulnerable: Ivanti web component
- Flaw: Authentication bypass
- Impact: Restricted resource access
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can bypass access controls on Ivanti Connect Secure and Ivanti Policy Secure. This allows an attacker to access restricted resources and potentially gain further access to the organization's systems. The attack leverages the web component's failure to properly validate user authentication. This could lead to unauthorized access to sensitive data or systems, impacting business operations and data integrity.
- Publicly accessible web component.
- Attacker bypasses authentication checks.
- Access restricted resources.
Live Threat
Current exploitation, exposure, and threat context
An authentication bypass vulnerability exists in the web component of Ivanti Connect Secure and Ivanti Policy Secure. This allows a remote attacker to access restricted resources by bypassing control checks. When combined with a command injection vulnerability, an unauthenticated attacker can execute arbitrary commands on the system. This exploit chain has been actively used in the wild by various threat actors.
- Likely advanced attacker skill level.
- No authentication required.
- Significant business risk.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An authentication bypass vulnerability exists in Ivanti Connect Secure and Ivanti Policy Secure components. This allows remote attackers to access restricted resources by bypassing control checks. The vulnerability has been observed in active exploitation campaigns and is listed as a known exploited vulnerability.
- Identify exposed Ivanti appliances.
- Reduce exposure or isolate affected systems.
- Apply vendor fixes, verify, and monitor.
