CVE-2024-13843: Ivanti Connect Secure Info Disclosure Bug

CVE-2024-13843 Overview

CVE-2024-13843 is a cleartext storage of sensitive information vulnerability affecting Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3. This vulnerability allows a local authenticated attacker with administrator privileges to read sensitive data that should otherwise be protected through encryption or other secure storage mechanisms.

Critical Impact

Administrative users with local access can extract sensitive information stored in cleartext, potentially compromising credentials, configuration data, or other confidential information managed by these VPN and access control appliances.

Affected Products

• Ivanti Connect Secure versions prior to 22.7R2.6
• Ivanti Policy Secure versions prior to 22.7R1.3
• All Ivanti Connect Secure 22.7 releases from R1 through R2.5

Discovery Timeline

• February 11, 2025 - CVE-2024-13843 published to NVD
• February 20, 2025 - Last updated in NVD database

Technical Details for CVE-2024-13843

Vulnerability Analysis

This vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information), which occurs when an application stores sensitive data in cleartext within a resource that might be accessible to other users or attackers. In the context of Ivanti Connect Secure and Policy Secure appliances, this means that sensitive data—which could include authentication credentials, session tokens, encryption keys, or configuration secrets—is stored without proper encryption or obfuscation.

The attack requires local access to the affected system and administrative privileges, which limits the attack surface but does not eliminate the risk. Insider threats, compromised administrator accounts, or attackers who have already gained elevated access through other means could leverage this vulnerability to harvest sensitive information for further attacks or lateral movement.

Root Cause

The root cause stems from improper implementation of secure storage practices within Ivanti Connect Secure and Policy Secure. Sensitive information that should be encrypted at rest is instead stored in cleartext format within configuration files, databases, or other storage mechanisms accessible to administrators. This design flaw violates the principle of defense in depth, where multiple layers of protection should safeguard sensitive data even from privileged users who should not have direct access to raw credential material.

Attack Vector

The attack vector is local, requiring an authenticated attacker with administrative privileges to access the affected system. The exploitation scenario involves:

1. An attacker gains administrative access to the Ivanti appliance (either through legitimate credentials or via compromise)
2. The attacker accesses local storage locations where sensitive data is maintained
3. Due to the cleartext storage vulnerability, the attacker can directly read sensitive information without needing to decrypt or otherwise process the data
4. The extracted information can be used for credential theft, privilege escalation, or attacks against connected systems and users

This vulnerability enables sensitive data extraction that bypasses intended access controls. An administrator with local access to the Ivanti appliance can locate and read configuration files or database entries containing sensitive information stored in cleartext format. For detailed technical information, refer to the Ivanti February Security Advisory.

Detection Methods for CVE-2024-13843

Indicators of Compromise

• Unusual administrative access patterns to configuration directories or sensitive file locations on Ivanti appliances
• Unexpected file read operations targeting credential stores or configuration databases by admin accounts
• Evidence of bulk data extraction or copying of configuration files from the appliance
• Anomalous login activity from administrator accounts, particularly from unusual locations or at unusual times

Detection Strategies

• Monitor administrative access logs for unusual read operations targeting sensitive configuration areas
• Implement file integrity monitoring on Ivanti Connect Secure and Policy Secure appliances to detect unauthorized access to sensitive storage locations
• Deploy behavioral analytics to identify anomalous administrator activities that deviate from established baselines
• Correlate access patterns across security tools to identify potential insider threat activity

Monitoring Recommendations

• Enable comprehensive audit logging on all Ivanti Connect Secure and Policy Secure appliances
• Forward logs to a centralized SIEM for correlation and analysis
• Establish alerting rules for administrative access to sensitive configuration files outside of maintenance windows
• Conduct regular reviews of administrator account activity and access patterns

How to Mitigate CVE-2024-13843

Immediate Actions Required

• Upgrade Ivanti Connect Secure to version 22.7R2.6 or later immediately
• Upgrade Ivanti Policy Secure to version 22.7R1.3 or later immediately
• Review administrator account access and revoke unnecessary privileges
• Audit recent administrative activity for signs of sensitive data access

Patch Information

Ivanti has released security updates that address this vulnerability. Customers should upgrade to the following versions:

• Ivanti Connect Secure: Version 22.7R2.6 or later
• Ivanti Policy Secure: Version 22.7R1.3 or later

For complete patch details and download instructions, refer to the Ivanti February Security Advisory.

Workarounds

• Implement strict access controls to limit administrative access to only essential personnel
• Enable multi-factor authentication for all administrative accounts to reduce the risk of credential compromise
• Segment Ivanti appliances on restricted network segments with enhanced monitoring
• Rotate any credentials or sensitive data that may have been exposed prior to patching

# Verify current Ivanti Connect Secure version
show version

# After upgrade, verify the new version is installed
# Expected: 22.7R2.6 or later for Connect Secure
# Expected: 22.7R1.3 or later for Policy Secure