CVE-2024-11007: Ivanti Connect Secure RCE Vulnerability

CVE-2024-11007 Overview

CVE-2024-11007 is a command injection vulnerability [CWE-78] affecting Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1. The 9.1Rx branches are not affected. A remote authenticated attacker with administrator privileges can exploit the flaw to execute arbitrary operating system commands on the underlying appliance. Successful exploitation leads to remote code execution with the privileges of the affected service.

Critical Impact
An authenticated administrator can achieve remote code execution on Ivanti Connect Secure and Policy Secure appliances, compromising confidentiality, integrity, and availability of the gateway.

Affected Products

Ivanti Connect Secure versions prior to 22.7R2.1 (including 22.7, 22.7R1, 22.7R1.1 through 22.7R1.5, and 22.7R2)
Ivanti Policy Secure versions prior to 22.7R1.1 (including 22.7 and 22.7R1)
Not applicable to the 9.1Rx release branch

Discovery Timeline

2024-11-12 - CVE-2024-11007 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11007

Vulnerability Analysis

The issue is an OS command injection weakness classified under [CWE-78]. Administrative interfaces on Ivanti Connect Secure and Policy Secure pass user-supplied input into a system command context without sufficient neutralization. An authenticated administrator can inject shell metacharacters that the underlying operating system interprets as additional commands. The result is arbitrary command execution in the appliance runtime, which affects a gateway typically positioned at the network edge.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. Input reaching a command execution routine is concatenated into a shell invocation rather than being passed through a parameterized API or strict allow-list validation. Metacharacters such as ;, |, &, backticks, and $() are not filtered before the command is executed.

Attack Vector

Exploitation requires network access to the administrative interface and valid administrator credentials. The attack is remote and requires no user interaction, but the high privilege prerequisite limits the pool of attackers to those who already possess admin access or have obtained credentials through phishing, credential reuse, or a prior compromise. An EPSS score of 1.652% places the vulnerability in the 74th percentile for exploitation likelihood.

No public proof-of-concept code is available for CVE-2024-11007.
Refer to the Ivanti Security Advisory for authoritative technical details:
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Detection Methods for CVE-2024-11007

Indicators of Compromise

Unexpected child processes spawned by Ivanti Connect Secure or Policy Secure web/administrative service processes.
Administrative session activity from unusual source IP addresses or during off-hours, especially followed by configuration changes.
Shell metacharacters such as ;, |, &, `, or $() appearing in administrative request parameters recorded in gateway logs.
New or modified files in web-accessible directories, or outbound connections initiated by the appliance to unfamiliar hosts.

Detection Strategies

Correlate administrative authentication events with subsequent process execution telemetry to surface command spawning that deviates from routine admin activity.
Alert on process lineage where the Ivanti web service is the parent of shell interpreters such as /bin/sh, /bin/bash, or utilities like curl, wget, nc, or python.
Inspect administrative HTTP requests for shell metacharacters in parameters that historically only carried alphanumeric values.

Monitoring Recommendations

Forward Ivanti Connect Secure and Policy Secure syslog, admin access logs, and authentication events to a centralized SIEM for retention and correlation.
Monitor egress traffic from appliance management interfaces; the gateway should rarely initiate arbitrary outbound connections.
Track configuration and account changes on the appliance and alert on modifications outside approved change windows.

How to Mitigate CVE-2024-11007

Immediate Actions Required

Upgrade Ivanti Connect Secure to version 22.7R2.1 or later, and Ivanti Policy Secure to version 22.7R1.1 or later.
Restrict access to the administrative interface to a limited set of trusted management IP addresses or an out-of-band management network.
Enforce multi-factor authentication for all administrator accounts and rotate credentials that may have been exposed.
Review recent administrator activity, configuration changes, and appliance logs for signs of exploitation prior to patching.

Patch Information

Ivanti has released fixed versions that address CVE-2024-11007. Refer to the Ivanti Security Advisory for the complete list of fixed builds and installation guidance. The 9.1Rx branch is not affected and does not require a patch for this CVE.

Workarounds

Limit administrative access to management VLANs or jump hosts and block administrative endpoints from the public internet.
Reduce the number of accounts with administrator privileges and audit privileged group membership.
Require named administrator accounts with strong authentication so that any exploitation attempt is attributable and reviewable.

bash

# Example: restrict administrative access at the network perimeter
# Only allow the management subnet to reach the Ivanti admin interface (TCP/443)
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP