CVE-2024-37404: Ivanti Connect Secure RCE Vulnerability

CVE-2024-37404 Overview

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.

Critical Impact

This vulnerability allows remote code execution on compromised systems, putting sensitive data and system integrity at high risk.

Affected Products

• Ivanti Connect Secure (Versions before 22.7R2.1)
• Ivanti Connect Secure (Versions before 9.1R18.9)
• Ivanti Policy Secure (Versions before 22.7R1.1)

Discovery Timeline

• 2024-10-18T23:15:03.580 - CVE CVE-2024-37404 published to NVD
• 2025-09-23T02:10:06.103 - Last updated in NVD database

Technical Details for CVE-2024-37404

Vulnerability Analysis

The vulnerability arises from improper input validation in the admin portal of Ivanti Connect Secure. This flaw enables attackers, after authentication, to execute arbitrary code on the server, which can lead to full system compromise if exploited effectively.

Root Cause

The root cause is a lack of rigorous input validation before processing user inputs in the web application’s admin portal.

Attack Vector

The attack vector is through network-based inputs that are improperly validated, allowing attackers to execute code remotely.

# Example exploitation code (this is a hypothetical sanitized example)
POST /admin/login HTTP/1.1
Host: target.com
Content-Type: application/json

{
    "username": "attacker",
    "password": "password",
    "command": "run-malicious-code"
}

Detection Methods for CVE-2024-37404

Indicators of Compromise

• Unusual outbound traffic
• Unexpected processes running on the server
• Modification of existing files or the presence of new, unverified files

Detection Strategies

Implement monitoring for unusual authentication attempts and resource access patterns. Use anomaly detection techniques to identify deviations from normal user behavior within the network.

Monitoring Recommendations

Regularly audit logs for suspicious entries and use behavior analytics to detect anomalies. Leverage SentinelOne’s AI-driven threat detection to quickly identify and mitigate risks associated with this vulnerability.

How to Mitigate CVE-2024-37404

Immediate Actions Required

• Apply the latest security patch provided by Ivanti.
• Restrict network access to the admin portal.
• Implement additional authentication factors.

Patch Information

Ivanti has released patches to address this vulnerability. Users are advised to update to version 22.7R2.1 or 9.1R18.9 for Connect Secure, and 22.7R1.1 for Policy Secure.

Workarounds

If patches cannot be applied immediately, restrict access to the admin portal through firewall rules and enforce strong authentication mechanisms.

# Configuration example to restrict admin access
iptables -A INPUT -s <trusted-ip> -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP