Ivanti warns of a new actively exploited Cloud Services Appliance (CSA) flaw

Ivanti warned of a new Cloud Services Appliance (CSA) vulnerability that is being exploited in attacks in the wild against a limited number of customers.

Ivanti warned of a new Cloud Services Appliance (CSA) vulnerability, tracked as CVE-2024-8963 (CVSS score of 9.4), actively exploited in attacks in the wild against a limited number of customers. The vulnerability is a path traversal security issue.

A remote unauthenticated attacker could exploit the vulnerability to access restricted functionality. An attacker could chain the issue with the recently disclosed flaw CVE-2024-8190 to bypass admin authentication and execute arbitrary commands on the appliance. 

“Ivanti is disclosing a critical vulnerability in Ivanti CSA 4.6 which was incidentally addressed in the patch released on 10 September (CSA 4.6 Patch 519). Successful exploitation could allow a remote unauthenticated attacker to access restricted functionality.” reads the advisory. “If CVE-2024-8963 is used in conjunction with CVE-2024-8190 an attacker can bypass admin authentication and execute arbitrary commands on the appliance.” 

The company note that CSA 4.6 is End-of-Life, and no longer receives updates for OS or third-party libraries. Customers must upgrade to Ivanti CSA 5.0 for continued support, this version is not impacted by this vulnerability.  

“We are aware of a limited number of customers who have been exploited by this vulnerability.” added the company.

The company discovered the vulnerability while investigating the exploitation that Ivanti disclosed on 13 September.

“The vulnerability was discovered as we were investigating the exploitation that Ivanti disclosed on 13 September.” continues the advisory. “As we were evaluating the root cause of this vulnerability, we discovered that the issue had been incidentally addressed with some of the functionality removal that had been included in patch 519.”

Ivanti recommends customers of checking the Cloud Services Appliance (CSA) for any modified or newly added administrative users. Although inconsistent, some attack attempts may appear in the local broker logs. They also recommend reviewing Endpoint Detection and Response (EDR) alerts if such tools are installed on the CSA. Since the CSA is an edge device, Ivanti emphasizes the importance of a layered security approach and strongly recommends installing an EDR tool on the appliance.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cloud Services Appliance)