CVE-2024-13813: Ivanti Secure Access Client Privilege Escalation

CVE-2024-13813 Overview

CVE-2024-13813 is an insecure permissions vulnerability affecting Ivanti Secure Access Client before version 22.8R1. The vulnerability stems from insufficient permission controls that allow a local authenticated attacker to delete arbitrary files on the system. This type of arbitrary file deletion vulnerability can lead to significant system instability, denial of service conditions, or potentially enable further exploitation by removing critical security controls or system files.

Critical Impact

Local authenticated attackers can exploit insufficient permissions in Ivanti Secure Access Client to delete arbitrary files, potentially causing system instability, denial of service, or enabling privilege escalation by removing security controls.

Affected Products

• Ivanti Secure Access Client versions prior to 22.8R1
• Ivanti Connect Secure (ICS) deployments using vulnerable client versions
• Ivanti Policy Secure (IPS) deployments using vulnerable client versions

Discovery Timeline

• 2025-02-11 - CVE-2024-13813 published to NVD
• 2025-02-20 - Last updated in NVD database

Technical Details for CVE-2024-13813

Vulnerability Analysis

This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The Ivanti Secure Access Client fails to properly restrict file operations, allowing local users with standard privileges to delete files outside of their intended scope. The vulnerability requires local access and authentication, meaning an attacker must already have some level of access to the target system.

The security impact is primarily focused on integrity and availability. An attacker cannot directly read sensitive information through this vulnerability, but the ability to delete arbitrary files poses serious risks. Deleting critical system files could render the system inoperable, while removing security configurations or log files could facilitate further attacks or cover an attacker's tracks.

Root Cause

The root cause of CVE-2024-13813 is improper permission assignment within the Ivanti Secure Access Client application. The client software operates with elevated privileges but does not adequately verify or restrict file deletion operations initiated by lower-privileged users. This allows authenticated users to leverage the application's elevated context to perform file operations they would not normally be authorized to execute.

The vulnerability likely exists in a component that handles temporary files, cache management, or configuration updates, where file paths are not properly sanitized or permission checks are not enforced before deletion operations.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to a system with the vulnerable Ivanti Secure Access Client installed. The exploitation does not require user interaction and can be performed with low privileges.

An attacker could exploit this vulnerability by manipulating file paths or leveraging symbolic links (symlinks) to redirect deletion operations to arbitrary locations on the file system. By pointing a deletable resource to a critical system file or security configuration, the attacker can cause the application to delete the targeted file when performing its normal operations.

The attack could be used to:

• Delete system files causing denial of service
• Remove security software configurations
• Delete audit logs to cover malicious activity
• Remove access control files to facilitate privilege escalation

Detection Methods for CVE-2024-13813

Indicators of Compromise

• Unexpected deletion of system files or security configurations coinciding with Ivanti Secure Access Client activity
• Presence of symbolic links pointing to sensitive system locations in Ivanti client directories
• Anomalous file system activity patterns from the Ivanti Secure Access Client process
• Missing or corrupted log files that were previously intact

Detection Strategies

• Monitor file system activity for the Ivanti Secure Access Client process, particularly file deletion operations outside expected directories
• Implement file integrity monitoring (FIM) on critical system files and security configurations
• Deploy endpoint detection rules that alert on symbolic link creation in application directories followed by file deletions
• Audit user activity on systems with vulnerable Ivanti client versions

Monitoring Recommendations

• Enable detailed audit logging for file system operations on endpoints running Ivanti Secure Access Client
• Configure SIEM rules to correlate file deletion events with Ivanti client process activity
• Establish baseline behavior for the Ivanti client and alert on deviations
• Monitor for creation of symbolic links in user-accessible directories that point to protected system locations

How to Mitigate CVE-2024-13813

Immediate Actions Required

• Upgrade Ivanti Secure Access Client to version 22.8R1 or later immediately
• Inventory all systems running vulnerable versions of Ivanti Secure Access Client
• Implement enhanced monitoring on systems that cannot be immediately patched
• Review file system permissions and ensure critical files have appropriate access controls

Patch Information

Ivanti has released version 22.8R1 of the Secure Access Client which addresses this vulnerability. Administrators should consult the Ivanti Security Advisory for February for complete patch details and upgrade instructions. The advisory covers multiple CVEs affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Secure Access Client.

Workarounds

• Restrict local access to systems with vulnerable Ivanti client installations to only essential users
• Implement application whitelisting to prevent unauthorized execution of tools that could be used to exploit the vulnerability
• Use file system monitoring tools to detect and alert on suspicious file operations
• Apply principle of least privilege to minimize the number of users with local system access

# Verify Ivanti Secure Access Client version on Windows
# Check installed version in Programs and Features or via PowerShell
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Ivanti Secure Access*"} | Select-Object Name, Version

# Enable file system auditing for sensitive directories (Windows)
auditpol /set /subcategory:"File System" /success:enable /failure:enable