Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2024-21887.
Upgrade to ProDetect Ivanti Connect Secure Authenticated Command Injection (CVE-2024-21887) in Splunk
CVE-2024-21887 is a critical authenticated command injection vulnerability (CVSS 9.1) in Ivanti Connect Secure and Policy Secure web components. When chained with the authentication bypass CVE-2023-46805, unauthenticated remote attackers can execute arbitrary commands on the appliance as root. Nation-state threat actors (UNC5221) exploited this as a zero-day to deploy LIGHTWIRE, WIREFIRE, and FRAMESTING web shells and conduct credential harvesting and lateral movement. CISA added this to the KEV catalog in January 2024.
MITRE ATT&CK
SPL Detection Query
index=proxy OR index=network OR index=web sourcetype=access_combined OR sourcetype=cisco:asa OR sourcetype=pan:traffic OR sourcetype=ivanti:ics
| eval dest_host=coalesce(dest_host, host, cs_host)
| eval uri=coalesce(uri, cs_uri_stem, uri_path)
| eval src_ip=coalesce(src_ip, c_ip, src)
| eval http_method=coalesce(http_method, cs_method, method)
| eval status=coalesce(status, sc_status, http_status_code)
| where (uri LIKE "/api/v1/%" OR uri LIKE "/dana-ws/%" OR uri LIKE "/dana-admin/%")
| eval injection_indicators=case(
match(uri, "[;|&`\$()\{\}\[\]]"), "shell_metachar_in_uri",
match(uri, "%3[Bb2Cc7c8Ee]"), "url_encoded_shell_metachar",
match(lower(uri), "(wget|curl|bash|python|perl|ncat|chmod|base64|mkfifo)"), "command_in_uri",
match(lower(uri), "(totp/user-backup-code|archiving/cloud-server-test|maintenance/reset)"), "known_vuln_endpoint",
1=1, "none"
)
| where injection_indicators!="none" OR (http_method IN ("POST","PUT") AND uri LIKE "/api/v1/%" AND status IN ("200","201","204"))
| eval chain_bypass=if(match(uri, "(dana-na|dana-ws|saml|license)"), "possible_auth_bypass_chain", "direct_authenticated")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(status) as statuses values(injection_indicators) as indicators by src_ip dest_host chain_bypass
| where count >= 1
| sort - countSplunk detection for CVE-2024-21887 command injection against Ivanti Connect Secure and Policy Secure API endpoints. Correlates requests to vulnerable API paths with command injection indicators and identifies potential chaining with CVE-2023-46805 authentication bypass.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate administrative API calls from known management IP ranges
- Automated compliance scanning tools targeting Ivanti endpoints
- Penetration testing activities with prior authorization
- Ivanti internal health-check mechanisms accessing maintenance endpoints
Other platforms for CVE-2024-21887
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2024-21887 Command Injection via TOTP Backup Code Endpoint
Expected signal: HTTP POST to /api/v1/totp/user-backup-code/ with shell metacharacters in request body, followed by file creation event in /tmp/ visible in process audit logs
- Test 2CVE-2023-46805 + CVE-2024-21887 Full Chain — Unauthenticated RCE
Expected signal: Sequence of: GET to /dana-na/auth/saml-sso.cgi with path traversal, 200 response with session cookie, then PUT to /api/v1/system/maintenance/archiving/cloud-server-test-connection with shell metacharacters in host field, followed by outbound HTTP callback from appliance
- Test 3Post-Exploitation Web Shell Deployment Simulation
Expected signal: File creation event at /home/webserver/htdocs/dana-na/auth/ for a new .pl or .py file; subsequent GET request to that file path with query parameters (cmd=, exec=, c=); process spawning by the web server daemon executing perl or python
- Test 4Credential Harvesting Simulation via Ivanti Config API
Expected signal: GET requests to Ivanti configuration API endpoints for user-roles and authentication server configuration; successful 200 responses containing credential or LDAP bind DN data
References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2024-21887
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways
- https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2024-21887 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month