Outbreak Alert: Ivanti Connect Secure and Policy Secure Attack

[bmali]

FortiRecon provides outside-in coverage for risks toward customers.  External Attack Surface Management helps customers identify exposure to known and unknown enterprise assets and associated vulnerabilities across the enterprise. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2023-46805
CVE Title	Ivanti ICS and Ivanti Policy Secure Security Bypass
NVD Severity	High
FortiRecon Severity	Critical
Exploited	Yes
Exploited by Ransomware Group(s)	None
Exploited by APT Group(s)	Yes (UTA0178, UTA0188, UNC5221)
Included in CISA KEV List	Yes
Available working exploit(s)	1
Available POC exploit(s)	9
Darknet Mention(s)	Discussion on 1 Darknet Forum
	Ramp
Telegram Mention(s)	Discussion on 1 Telegram channel
	Termux Israel
FortiRecon Intelligence Reporting(s)	6 (OSINT, TECHINT, Darknet)
Social Media Mention(s)	11
EASM Scanner	No

CVE ID	CVE-2024-21887
CVE Title	Ivanti ICS and Ivanti Policy Secure Command Execution
NVD Severity	Critical
FortiRecon Severity	Critical
Exploited	Yes
Exploited by Ransomware Group(s)	None
Exploited by APT Group(s)	Yes (UTA0178, UTA0188, UNC5221)
Included in CISA KEV List	Yes
Available working exploit(s)	1
Available POC exploit(s)	10
Darknet Mention(s)	Discussion on 1 Darknet Forum
	Ramp
Telegram Mention(s)	Discussion on 1 Telegram channel
	Termux Israel
FortiRecon Intelligence Reporting(s)	6 (OSINT, TECHINT, Darknet)
Social Media Mention(s)	2
EASM Scanner	No

CVE ID	CVE-2024-21888
CVE Title	Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways privilege escalation
NVD Severity	High
FortiRecon Severity	Medium
Exploited	No
Exploited by Ransomware Group(s)	None
Exploited by APT Group(s)	None
Included in CISA KEV List	No
Available working exploit(s)	None
Available POC exploit(s)	None
Darknet Mention(s)	Discussion on 1 Darknet Forum -RAMP
Telegram Mention(s)	None
FortiRecon Intelligence Reporting(s)	None
Social Media Mention(s)	None
EASM Scanner	No

CVE ID	CVE-2024-21893
CVE Title	Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways server-side request forgery
NVD Severity	High
FortiRecon Severity	Critical
Exploited	Yes
Exploited by Ransomware Group(s)	None
Exploited by APT Group(s)	None
Included in CISA KEV List	Yes
Available working exploit(s)	None
Available POC exploit(s)	2
Darknet Mention(s)	Discussion on 1 Darknet Forum -Ramp
Telegram Mention(s)	Discussion on 4 Telegram channels - Freedom F0x - ARVIN - APT IRAN - Termux Israel
FortiRecon Intelligence Reporting(s)	4 (OSINT, TECHINT)
Social Media Mention(s)	None
EASM Scanner	No

CVE ID	CVE-2024-22024
CVE Title	Ivanti Connect Secure, Policy Secure and ZTA gateways information disclosure
NVD Severity	High
FortiRecon Severity	Medium
Exploited	No
Exploited by Ransomware Group(s)	None
Exploited by APT Group(s)	None
Included in CISA KEV List	No
Available working exploit(s)	None
Available POC exploit(s)	2
Darknet Mention(s)	None
Telegram Mention(s)	Discussion on 2 Telegram channels - Freedom F0x - APT IRAN
FortiRecon Intelligence Reporting(s)	None
Social Media Mention(s)	None
EASM Scanner	No