Ivanti Connect Secure Unauthenticated Remote Code Execution

This Metasploit module chains a server side request forgery (SSRF) vulnerability (CVE-2024-21893) and a command injection vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and 22.x are vulnerable, prior to the vendor patch released on Feb 1, 2024. It is unknown if unsupported versions 8.x and below are also vulnerable.

code code execution command command injection connect connect secure cve cve-2024-21887 cve-2024-21893 exploit forgery injection ivanti ivanti connect secure ivanti policy secure metasploit patch policy policy secure remote code remote code execution request server server side ssrf unauthenticated vendor vulnerability vulnerable