Threat update

Three Ivanti Cloud Service Appliance (CSA) vulnerabilities are being exploited and weaponized in the wild. Read this Cybersecurity Threat Advisory to learn how you can mitigate your risk of being targeted.

Technical Detail and Additional Info

What is the threat?

The Ivanti CSA vulnerabilities, catalogued as CVE-2024-9380, CVE-2024-8963, and CVE-2024-8190, can enable attackers to bypass authentication mechanisms, escalate privileges, and remotely execute code on targeted systems.

It has been observed that adversaries are initiating attacks by exploiting CVE-2024-9380 to bypass authentication and gain access to the CSA's administrative interface. Next, they leverage CVE-2024-8963 to escalate their access privileges to an administrative level, giving them full control over the device. Finally, the attacker exploits CVE-2024-8190 to install malware, create persistence, and deploy further attacks on the internal network.

These vulnerabilities, when combined, form a highly effective attack chain that allows the threat actor to transition from unauthorized access to full system compromise with ease. This has made Ivanti CSA an ideal target for nation-state actors, as compromising CSA can allow them lateral movement to the broader infrastructure it manages. 

Why is it noteworthy?

These vulnerabilities are especially concerning due to the nature of Ivanti CSA, which serves as a critical gateway for secure remote access to networks. Exploiting this appliance provides attackers access and the opportunity to gain a foothold inside an organization's perimeter defenses, bypassing VPNs, firewalls, and other security measures. 

What is the exposure or risk?

Organizations using Ivanti CSA for secure remote access are at immediate risk. An exploited CSA device could give attackers unauthorized access to internal networks. This can potentially lead to data breaches, ransomware attacks, or the disruption of business operations. The risks extend beyond direct financial and operational impact, as compromised networks can expose sensitive information, damage reputations, and lead to regulatory penalties. Given the suspected nation-state involvement, these attacks could also have geopolitical implications, affecting government entities and critical infrastructure providers. 

What are the recommendations?

 LBT Technology Group recommends organizations to take these steps to defend their environment against this threat:

• Apply Ivanti patches for these vulnerabilities to all affected CSA instances as soon as possible.
• Limit access to CSA devices to only trusted IP addresses and users.
• Implement strong authentication measures, including multi-factor authentication (MFA).
• Isolate critical systems and restrict lateral movement from CSA devices to other parts of the network.
• Update incident response playbooks to include scenarios involving CSA exploitation and conduct tabletop exercises to ensure readiness.

References

 For more in-depth information about the recommendations, please visit the following links:

• https://thehackernews.com/2024/10/nation-state-attackers-exploiting.html

If you have any questions, please contact LBT's Sales Engineer.