CVE-2022-35254: Ivanti Connect Secure DoS Vulnerability

CVE-2022-35254 Overview

CVE-2022-35254 is a denial-of-service vulnerability affecting multiple Ivanti enterprise security products. An unauthenticated attacker can exploit this vulnerability to disrupt the availability of Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero-Trust Access. The vulnerability stems from improper resource management (CWE-400) and use-after-free conditions (CWE-416), allowing remote attackers to crash affected services without requiring any authentication.

Critical Impact

Remote unauthenticated attackers can cause complete denial of service to critical enterprise VPN and zero-trust access infrastructure, potentially disrupting remote workforce connectivity and security policy enforcement.

Affected Products

• Ivanti Connect Secure (ICS) versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4
• Ivanti Policy Secure (IPS) versions prior to 9.1R17 and 22.3R1
• Ivanti Neurons for Zero-Trust Access versions prior to 22.3R1

Discovery Timeline

• 2022-12-05 - CVE-2022-35254 published to NVD
• 2025-04-24 - Last updated in NVD database

Technical Details for CVE-2022-35254

Vulnerability Analysis

This vulnerability represents a serious availability threat to organizations relying on Ivanti's enterprise security solutions for remote access and zero-trust network access. The combination of CWE-416 (Use After Free) and CWE-400 (Uncontrolled Resource Consumption) indicates that the vulnerability involves memory management issues that can be triggered by network requests.

The unauthenticated nature of this attack significantly increases the risk profile, as threat actors do not need valid credentials or prior access to the target system to exploit this vulnerability. Given that Ivanti Connect Secure and Policy Secure are often internet-facing appliances designed to provide secure remote access, they present an attractive target for attackers seeking to disrupt organizational operations.

Root Cause

The vulnerability is rooted in two distinct weaknesses: a use-after-free condition (CWE-416) where the application accesses memory after it has been freed, and uncontrolled resource consumption (CWE-400) where the application fails to properly limit resource allocation. When combined, these flaws allow an attacker to craft requests that either exhaust system resources or trigger memory corruption leading to service crashes.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker with network access to the affected Ivanti appliance can send specially crafted requests designed to trigger the vulnerability. The attack targets the availability of the service, causing legitimate users to lose access to VPN and zero-trust access services.

The exploitation mechanism involves sending malformed or excessive requests that exploit the resource management and memory handling flaws in the affected products. Since no authentication is required, the attacker only needs network reachability to the target appliance's management or user-facing interfaces.

Detection Methods for CVE-2022-35254

Indicators of Compromise

• Unexpected service restarts or crashes of Ivanti Connect Secure, Policy Secure, or Neurons for Zero-Trust Access appliances
• Unusual patterns of connection attempts from unknown IP addresses targeting the appliance
• Memory exhaustion alerts or out-of-memory conditions on affected appliances
• Log entries indicating service termination without administrative action

Detection Strategies

• Monitor system logs for unexpected service crashes or restarts of Ivanti services
• Implement network traffic analysis to detect anomalous request patterns targeting Ivanti appliances
• Configure alerting for high connection rates or unusual traffic volumes to VPN endpoints
• Deploy intrusion detection signatures for known DoS attack patterns against Ivanti products

Monitoring Recommendations

• Enable detailed logging on Ivanti appliances and forward logs to a centralized SIEM for analysis
• Set up availability monitoring with automated alerting for service interruptions
• Monitor resource utilization (CPU, memory) on affected appliances for abnormal spikes
• Implement baseline traffic analysis to detect deviations indicating potential attack activity

How to Mitigate CVE-2022-35254

Immediate Actions Required

• Identify all Ivanti Connect Secure, Policy Secure, and Neurons for Zero-Trust Access deployments in your environment
• Verify current firmware/software versions against the fixed versions listed by Ivanti
• Prioritize patching of internet-facing appliances due to the unauthenticated nature of the vulnerability
• Implement network segmentation and access controls to limit exposure while patches are applied

Patch Information

Ivanti has released patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• Ivanti Connect Secure (ICS): Update to version 9.1R14.3, 9.1R15.2, 9.1R16.2, or 22.2R4 or later
• Ivanti Policy Secure (IPS): Update to version 9.1R17 or 22.3R1 or later
• Ivanti Neurons for Zero-Trust Access: Update to version 22.3R1 or later

For detailed patch information and download links, refer to the Pulse Secure Security Advisory SA45520.

Workarounds

• Restrict network access to Ivanti appliances to trusted IP ranges where possible using firewall rules
• Implement rate limiting at the network perimeter to reduce the impact of potential DoS attempts
• Consider deploying a web application firewall (WAF) or DDoS protection service in front of internet-facing appliances
• Ensure high availability configurations are in place to maintain service continuity during potential attacks

# Example: Restrict access to Ivanti appliance management interface
# Add to your perimeter firewall rules

# Allow only trusted admin IPs to management interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Implement connection rate limiting
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 50 -j DROP