CVE-2024-11006: Ivanti Connect Secure RCE Vulnerability

CVE-2024-11006 Overview

CVE-2024-11006 is a command injection vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure. The flaw exists in Ivanti Connect Secure versions prior to 22.7R2.1 and Ivanti Policy Secure versions prior to 22.7R1.1. The 9.1Rx branch is not affected. A remote authenticated attacker with administrative privileges can leverage the flaw to achieve remote code execution on the underlying appliance. The weakness is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
An authenticated administrator can execute arbitrary operating system commands on Ivanti Connect Secure and Ivanti Policy Secure appliances, compromising the confidentiality, integrity, and availability of the VPN gateway.

Affected Products

Ivanti Connect Secure versions prior to 22.7R2.1
Ivanti Policy Secure versions prior to 22.7R1.1
Ivanti Connect Secure 22.7, 22.7R1, 22.7R1.1 through 22.7R1.5, 22.7R2

Discovery Timeline

2024-11-12 - CVE-2024-11006 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11006

Vulnerability Analysis

The vulnerability is an operating system command injection issue in the administrative interface of Ivanti Connect Secure and Ivanti Policy Secure. An attacker who already holds administrator credentials can inject shell metacharacters into a parameter that is passed to an underlying system command. The injected commands execute in the context of the appliance runtime, providing a path from administrative access to full remote code execution.

Because Ivanti Connect Secure operates as a remote-access VPN gateway, code execution on the appliance yields a strategic position for network pivoting, credential capture, and interception of authenticated user sessions.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command call [CWE-78]. Input received through an authenticated administrative interface is concatenated into a shell command without sufficient sanitization or use of safe execution APIs. Shell metacharacters supplied by the attacker break out of the intended command context.

Attack Vector

Exploitation requires network reachability to the administrative interface and valid administrator credentials. The attacker submits a crafted request containing shell metacharacters in a vulnerable parameter. The appliance passes the tainted value into a system command, and the injected payload executes with the privileges of the service.

No verified public exploit code is available for this CVE. See the Ivanti Security Advisory for vendor-supplied technical context.

Detection Methods for CVE-2024-11006

Indicators of Compromise

Administrative HTTP requests containing shell metacharacters such as ;, |, &&, backticks, or $() in parameter values.
Unexpected child processes spawned by Ivanti Connect Secure or Policy Secure web services, such as /bin/sh, bash, curl, wget, or nc.
Outbound connections from the appliance to untrusted or previously unseen hosts following administrator authentication.
New or modified files in appliance writable directories, particularly scripts or binaries dropped after administrative sessions.

Detection Strategies

Correlate successful administrator logins with subsequent process execution events and outbound network activity from the appliance.
Alert on any interactive shell invocation originating from the Ivanti web service parent process.
Baseline administrative API usage and flag requests containing unusual encoding or command-injection payload patterns.

Monitoring Recommendations

Forward Ivanti Connect Secure and Policy Secure audit logs, access logs, and admin activity logs to a centralized SIEM for retention and correlation.
Monitor egress traffic from the appliance management interface for reverse shells, DNS tunneling, and unexpected outbound HTTPS.
Review the Ivanti Integrity Checker Tool (ICT) output on a scheduled cadence and after any administrator configuration change.

How to Mitigate CVE-2024-11006

Immediate Actions Required

Upgrade Ivanti Connect Secure to version 22.7R2.1 or later.
Upgrade Ivanti Policy Secure to version 22.7R1.1 or later.
Rotate all administrator credentials and API tokens used on affected appliances.
Restrict access to the administrative interface to a dedicated management network or bastion host.

Patch Information

Ivanti has released fixed versions for both products. See the Ivanti Security Advisory on Multiple CVEs for release notes and download details. Ivanti Connect Secure 22.7R2.1 and Ivanti Policy Secure 22.7R1.1 remediate the flaw. The 9.1Rx branch is not affected.

Workarounds

Limit administrator interface exposure to trusted management IP ranges via network ACLs and firewall rules.
Enforce multi-factor authentication for all administrator accounts to raise the barrier to abuse of admin-level access.
Audit and reduce the number of accounts holding administrative privileges on the appliance.
Run the Ivanti Integrity Checker Tool after upgrade to validate appliance integrity.

bash

# Configuration example: restrict admin interface access at the network edge
# Replace 10.0.0.0/24 with your dedicated management network
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP