CVE-2024-12058: Ivanti Connect Secure Info Disclosure

CVE-2024-12058 Overview

CVE-2024-12058 is an external control of a file name vulnerability affecting Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3. This vulnerability allows a remote authenticated attacker with administrative privileges to read arbitrary files from the affected system, potentially exposing sensitive configuration data, credentials, and other confidential information stored on the appliance.

Critical Impact

Authenticated administrators can exploit this file read vulnerability to access sensitive system files, potentially compromising configuration secrets, encryption keys, and other critical data on Ivanti VPN appliances.

Affected Products

• Ivanti Connect Secure versions before 22.7R2.6
• Ivanti Policy Secure versions before 22.7R1.3
• All Ivanti Connect Secure 22.7 release branches through 22.7R2.5

Discovery Timeline

• 2025-02-11 - CVE-2024-12058 published to NVD
• 2025-07-16 - Last updated in NVD database

Technical Details for CVE-2024-12058

Vulnerability Analysis

This vulnerability is classified as CWE-73 (External Control of File Name or Path), a weakness that occurs when an application uses external input to construct a pathname intended to identify a file or directory without properly neutralizing special elements. In the context of Ivanti Connect Secure and Policy Secure appliances, an authenticated administrator can manipulate file name parameters to read files outside the intended directory structure.

The vulnerability requires network access and high privileges (administrative credentials) to exploit, which limits the attack surface. However, the potential impact is significant because successful exploitation grants access to any readable file on the system with high confidentiality impact. This could include sensitive configuration files, cached credentials, SSL certificates, or other protected data.

Root Cause

The root cause of CVE-2024-12058 lies in insufficient validation of file path parameters within the administrative interface of Ivanti Connect Secure and Policy Secure. The application fails to properly sanitize or validate user-supplied file names, allowing path manipulation sequences or absolute paths to be processed without restriction.

When an administrator submits a request containing a manipulated file name parameter, the application processes the request without verifying that the target file resides within an authorized directory. This oversight enables directory traversal attacks where attackers can navigate outside the intended file system scope.

Attack Vector

The attack is conducted over the network against the administrative web interface of vulnerable Ivanti appliances. An attacker must first authenticate with valid administrative credentials to access the vulnerable functionality. Once authenticated, the attacker crafts malicious requests containing manipulated file path parameters.

The exploitation mechanism typically involves injecting path traversal sequences (such as ../) or absolute file paths into parameters that the application uses to read files. Because the vulnerability exists in the administrative interface, exploitation requires compromised admin credentials, insider threat scenarios, or chaining with other vulnerabilities that could grant admin access.

Given that Ivanti Connect Secure appliances often serve as the gateway for enterprise VPN access, successful exploitation could expose credentials, configuration data, or cryptographic materials that could be leveraged for lateral movement or further attacks against the organization's infrastructure.

Detection Methods for CVE-2024-12058

Indicators of Compromise

• Unusual file access patterns in application logs showing requests for system files outside normal operational directories
• Administrative session activity accessing sensitive file paths like /etc/passwd, configuration files, or certificate stores
• Anomalous log entries indicating path traversal sequences in HTTP request parameters
• Unexpected data exfiltration from Ivanti appliances to external destinations

Detection Strategies

• Monitor administrative interface access logs for requests containing path traversal patterns such as ../, ..%2f, or absolute Unix paths
• Implement file integrity monitoring on critical system files and configuration directories on Ivanti appliances
• Configure SIEM rules to alert on administrative sessions accessing files outside the expected application directories
• Review audit logs for administrative accounts showing unusual file read operations during non-business hours

Monitoring Recommendations

• Enable comprehensive logging on Ivanti Connect Secure and Policy Secure appliances with log forwarding to a centralized SIEM
• Establish baseline behavior for administrative file access patterns and alert on deviations
• Monitor for reconnaissance activities that may precede exploitation, such as directory enumeration attempts
• Implement network traffic analysis to detect potential data exfiltration of sensitive files from VPN appliances

How to Mitigate CVE-2024-12058

Immediate Actions Required

• Update Ivanti Connect Secure to version 22.7R2.6 or later immediately
• Update Ivanti Policy Secure to version 22.7R1.3 or later immediately
• Audit administrative accounts and ensure only necessary personnel have admin access to Ivanti appliances
• Review administrative access logs for any suspicious file read activities prior to patching

Patch Information

Ivanti has released security patches addressing this vulnerability in their February Security Advisory. The fixed versions are:

• Ivanti Connect Secure: Version 22.7R2.6 and later
• Ivanti Policy Secure: Version 22.7R1.3 and later

Organizations should download the appropriate patches from Ivanti's official support portal and follow the documented upgrade procedures. For detailed patch information and download links, refer to the Ivanti February Security Advisory.

Workarounds

• Restrict administrative interface access to trusted management networks only using firewall rules or network segmentation
• Implement multi-factor authentication for all administrative access to Ivanti appliances
• Consider using a jump server or privileged access management solution for administrative tasks
• Rotate any sensitive credentials or certificates that may have been stored on affected systems if compromise is suspected

# Example: Restrict admin interface access via firewall (iptables)
# Allow admin access only from management network 10.0.100.0/24
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify current Ivanti Connect Secure version via CLI
# Login to appliance and check version
show version