Ivanti Cloud Services Appliance OS Command Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-09-13
• EPSS: 89% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

CISA: Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 4 Oct 2024): As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-20…Vendor Advisory
• www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-servic…US Government Resource
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource