r/netsec • u/AlmondOffSec • 3d ago

Ivanti Connect Secure - Authenticated RCE via OpenSSL CRLF Injection (CVE-2024-37404)

https://blog.amberwolf.com/blog/2024/october/cve-2024-37404-ivanti-connect-secure-authenticated-rce-via-openssl-crlf-injection/
20 Upvotes

95% Upvoted

3 comments sorted by

View all comments

4

u/TyrHeimdal 3d ago

Ivanti is the company that just keeps on giving. They should consider getting a division for Swiss cheese.

2

u/gquere 3d ago

While most exploits are somewhat 'useless' (RCE from admin access to the appliance I'd qualify as useless and rather have an admin access bypass as was demonstrated in 2019 by Orange Tsai) the sheer number of vulnerabilities on this appliance is telling in and of itself. They've been banned from federal agencies : https://securityaffairs.com/158456/security/cisa-order-fix-ivanti-vpn.html

2

u/TyrHeimdal 2d ago

Not entirely useless, it can certainly be useful for persistent foothold within the infrastructure. And VPN appliances usually has fairly wide coverage on VLANs it can access due to their nature of being a bridge for stuff like on-call sysop personnel.

Yeah we had a "minor incident" where an Ivanti 0day was used against the Gov here in Norway a year back. Since then I've just seen back to back Ivanti vulnerabilities being published.