# [CVE-2024-21887] Ivanti Connect Secure & Policy Secure Command Injection Vulnerability
**Severity:** CRITICAL | **CVSS Base Score:** 9.1 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
**EPSS Exploit Probability:** 99.95% (Percentile: 99.97%)
**CISA KEV (In The Wild):** YES (Due: Mon Jan 22 2024 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** Multiple cybercrime and espionage groups
**Exploit Status:** active_wild
**Published:** 2024-01-12 | **Updated:** 2026-10-28

## Executive Summary
Critical command injection flaw in Ivanti Connect Secure VPN gateways allowing unauthenticated remote code execution.

## Common Weakness Enumeration (CWE)
- **CWE-77**: Improper Neutralization of Special Elements used in a Command ('Command Injection')

## Affected Vendors & Products
- **Vendor:** Ivanti | **Product:** Connect Secure (ICS)
  - **Affected Versions:** 9.x, 22.x prior to security patches
  - **Patched Version:** ICS 22.5R2.2 / 22.6R2.1

## Technical Root Cause Analysis (AI Defense Agent)
The API endpoint `/api/v1/license/keys-status/` fails to sanitize user inputs passed into internal python system exec routines. Chaining with the CVE-2023-46805 path traversal bypass removes all authentication barriers.

## Exploitation Mechanism & Attack Scenario
Adversary issues an HTTP GET to `/api/v1/license/keys-status/;[command]` through the path traversal wrapper. The command runs with root privileges on the FreeBSD underlying operating system.

## Enterprise Blast Radius
Total perimeter breach: theft of VPN session tokens, Active Directory credentials, internal subnet pivoting.

## Remediation & Mitigation Playbook
1. Apply Ivanti security patches and run the External Integrity Checker Tool (ICT).
2. Revoke all certificates, API keys, and Active Directory credentials passing through the gateway.
3. Isolate VPN management interfaces from untrusted external networks.

## Detection Guidance & Telemetry
Examine ICT logs for mismatched files in `/home/etc/manifest/` and unexpected modifications in `/pkg/do/`.

### Sigma Detection Rule
```yaml
title: Ivanti Connect Secure Command Injection
status: critical
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/api/v1/license/keys-status/'
  condition: selection
```


## References
- [Volexity Advisory: Zero-Day Exploitation of Ivanti Connect Secure](https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/) (advisory)
- [CISA Emergency Directive 24-01](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities) (cisa)