CVE-2024-38655: Ivanti Connect Secure RCE Vulnerability

CVE-2024-38655 Overview

CVE-2024-38655 is an argument injection vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure appliances. The flaw allows a remote authenticated attacker with administrative privileges to execute arbitrary code on the underlying system. The vulnerability is categorized under [CWE-88] (Improper Neutralization of Argument Delimiters in a Command). Ivanti disclosed the issue as part of a coordinated advisory covering multiple CVEs across Connect Secure, Policy Secure, and Secure Access Client.

Affected versions include Ivanti Connect Secure prior to 22.7R2.1 and 9.1R18.9, and Ivanti Policy Secure prior to 22.7R1.1 and 9.1R18.9.

Critical Impact
An authenticated administrator can escalate to remote code execution on Ivanti Connect Secure and Policy Secure appliances, gaining full control of a network edge device.

Affected Products

Ivanti Connect Secure versions prior to 22.7R2.1 and 9.1R18.9
Ivanti Policy Secure versions prior to 22.7R1.1 and 9.1R18.9
Ivanti Connect Secure branches 22.7R1, 22.7R1.1 through 22.7R1.5, 22.7R2, and 22.7R2.2

Discovery Timeline

2024-11-13 - CVE-2024-38655 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38655

Vulnerability Analysis

The vulnerability is an argument injection flaw in administrative functionality exposed by Ivanti Connect Secure and Ivanti Policy Secure. An attacker who is already authenticated as an administrator can inject unexpected arguments into a command executed by the appliance. These injected arguments alter the command's behavior and produce arbitrary code execution in the appliance context.

Successful exploitation compromises the confidentiality, integrity, and availability of the appliance. Because Connect Secure and Policy Secure act as VPN and network access control gateways, compromise of the device exposes internal networks, credentials handled by the appliance, and traffic passing through it.

Root Cause

The root cause is improper neutralization of argument delimiters passed to a downstream command interpreter [CWE-88]. Administrator-supplied input is used to build a command line without adequately separating operands from options. As a result, attacker-controlled strings are interpreted as additional command-line flags or parameters, changing how the underlying binary executes.

Attack Vector

The attack is remote over the network but requires prior authentication with administrative privileges. An attacker with valid admin credentials, obtained through credential theft, phishing, or prior compromise, submits a crafted request to a management interface. The injected arguments are then concatenated into a command executed by the appliance, resulting in arbitrary code execution. No user interaction is required.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

For technical details, see the Ivanti Security Advisory on Multiple CVEs.

Detection Methods for CVE-2024-38655

Indicators of Compromise

Unexpected administrative logins to Connect Secure or Policy Secure web consoles, especially from unusual source IPs or outside normal maintenance windows.
Outbound network connections from the appliance to external hosts that do not match update, license, or telemetry destinations.
Unexplained new or modified files, cron entries, or processes on the appliance following administrator activity.
Configuration changes or diagnostic command executions in appliance audit logs that contain unusual argument strings or shell metacharacters.

Detection Strategies

Review Ivanti appliance audit logs for administrative actions that include suspicious argument patterns, unexpected flags, or embedded delimiters.
Correlate admin authentication events with subsequent system-level command invocations to identify anomalous sequences.
Alert on any deviation from a known-good baseline of administrative commands and configuration changes on the appliance.

Monitoring Recommendations

Forward Ivanti Connect Secure and Policy Secure logs to a centralized SIEM or data lake for retention and correlation.
Monitor for privileged account use on the appliance and flag logins from IP ranges not on an approved administrator allowlist.
Track appliance software versions in asset inventory to identify systems that remain below the patched releases.

How to Mitigate CVE-2024-38655

Immediate Actions Required

Upgrade Ivanti Connect Secure to version 22.7R2.1 or 9.1R18.9 or later.
Upgrade Ivanti Policy Secure to version 22.7R1.1 or 9.1R18.9 or later.
Rotate credentials for all administrative accounts on affected appliances, particularly if compromise is suspected.
Restrict access to appliance administrative interfaces to a small set of trusted management networks.

Patch Information

Ivanti has released fixed builds addressing CVE-2024-38655. Customers should apply Ivanti Connect Secure 22.7R2.1 or 9.1R18.9, and Ivanti Policy Secure 22.7R1.1 or 9.1R18.9, per the Ivanti Security Advisory. Because the advisory bundles multiple CVEs, apply the fixed release rather than attempting to patch individual issues.

Workarounds

Limit administrative access to the appliance to a dedicated management VLAN or jump host until patching is complete.
Enforce multi-factor authentication on all administrator accounts to reduce the risk of credential-based abuse.
Audit and remove unused administrator accounts to reduce the attack surface required for exploitation.
Increase log retention on the appliance to support forensic investigation if exploitation is suspected.

bash

# Example: restrict admin interface access at the network edge
# Replace 10.0.0.0/24 with your management network
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP