CVE-2022-35258: Ivanti Connect Secure DoS Vulnerability

CVE-2022-35258 Overview

CVE-2022-35258 is a denial-of-service vulnerability affecting multiple Ivanti products including Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero-Trust Access. An unauthenticated attacker can exploit this vulnerability to cause a denial-of-service condition, potentially disrupting remote access and network security policy enforcement for organizations relying on these critical infrastructure components.

The vulnerability is associated with CWE-128 (Wrap-around Error) and CWE-682 (Incorrect Calculation), indicating issues with improper handling of numeric calculations that can lead to unexpected behavior and service disruption. These weaknesses can be exploited remotely without requiring authentication, making this vulnerability particularly concerning for internet-facing deployments.

Critical Impact

Unauthenticated attackers can remotely disrupt VPN connectivity and zero-trust access services, potentially affecting organizational remote workforce access and security policy enforcement.

Affected Products

• Ivanti Connect Secure (ICS) versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4
• Ivanti Policy Secure (IPS) versions prior to 9.1R17 and 22.3R1
• Ivanti Neurons for Zero-Trust Access versions prior to 22.3R1

Discovery Timeline

• December 5, 2022 - CVE-2022-35258 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-35258

Vulnerability Analysis

This vulnerability stems from improper numeric calculations within the affected Ivanti products. The combination of CWE-128 (Wrap-around Error) and CWE-682 (Incorrect Calculation) suggests that the vulnerability involves numeric operations that can result in wrap-around conditions or incorrect computational results when processing certain inputs.

The vulnerability can be exploited over the network without requiring any form of authentication. When triggered, the vulnerability causes a denial-of-service condition, making the affected services unavailable to legitimate users. This is particularly impactful for organizations using Ivanti Connect Secure as their primary VPN gateway or Ivanti Policy Secure for network access control.

Root Cause

The root cause lies in incorrect calculation handling within the affected software components. When processing specially crafted input, the system may encounter wrap-around errors in numeric computations, leading to resource exhaustion or application crashes. The improper boundary checks on numeric values allow attackers to trigger conditions that cause the service to become unresponsive.

Attack Vector

The attack can be initiated remotely over the network by an unauthenticated attacker. The exploitation does not require user interaction, making it suitable for automated attacks. An attacker can send specially crafted requests to the vulnerable services that trigger the incorrect calculation condition. The attack targets the availability of the service without compromising confidentiality or integrity of data.

Since authentication is not required, any internet-exposed Ivanti Connect Secure, Policy Secure, or Neurons for Zero-Trust Access instance running a vulnerable version is at risk. For detailed technical information about the vulnerability mechanism, refer to the Pulse Secure Security Advisory.

Detection Methods for CVE-2022-35258

Indicators of Compromise

• Unexpected service restarts or crashes of Ivanti Connect Secure, Policy Secure, or Neurons for Zero-Trust Access services
• Unusual patterns of connection failures reported by end users attempting to access VPN services
• Elevated error rates in application logs related to numeric processing or memory allocation failures
• Network traffic anomalies showing repeated connection attempts from specific source IPs targeting Ivanti services

Detection Strategies

• Monitor system logs for crash reports or unexpected service terminations in Ivanti products
• Implement network intrusion detection rules to identify malformed requests targeting Ivanti services
• Deploy application-layer monitoring to detect unusual request patterns that may indicate exploitation attempts
• Set up alerting for service availability degradation on Ivanti Connect Secure and Policy Secure endpoints

Monitoring Recommendations

• Configure SIEM rules to correlate service availability events with network traffic patterns
• Establish baseline metrics for normal service behavior and alert on significant deviations
• Monitor resource utilization (CPU, memory) on Ivanti appliances for abnormal spikes
• Implement synthetic monitoring to proactively detect service unavailability before user reports

How to Mitigate CVE-2022-35258

Immediate Actions Required

• Identify all Ivanti Connect Secure, Policy Secure, and Neurons for Zero-Trust Access deployments within your environment
• Verify current version numbers against the affected version list and prioritize patching vulnerable instances
• Implement rate limiting on network connections to Ivanti services to reduce the impact of potential exploitation
• Review network segmentation to ensure Ivanti services are not unnecessarily exposed to untrusted networks

Patch Information

Ivanti has released security patches addressing this vulnerability. Organizations should upgrade to the following versions or later:

• Ivanti Connect Secure: Upgrade to version 9.1R14.3, 9.1R15.2, 9.1R16.2, 22.2R4, or later
• Ivanti Policy Secure: Upgrade to version 9.1R17, 22.3R1, or later
• Ivanti Neurons for Zero-Trust Access: Upgrade to version 22.3R1 or later

Detailed patch information and download links are available in the Pulse Secure Security Advisory SA45520.

Workarounds

• Restrict network access to Ivanti services using firewall rules to allow only trusted IP ranges
• Implement web application firewall (WAF) rules to filter potentially malicious requests before they reach Ivanti services
• Consider deploying additional load balancing or failover configurations to maintain service availability during potential attacks
• Enable enhanced logging and monitoring to quickly detect and respond to exploitation attempts

# Example: Restrict access to Ivanti Connect Secure using iptables
# Allow only trusted corporate IP ranges
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP