CVE-2024-38657: Ivanti Connect Secure Path Traversal

CVE-2024-38657 Overview

CVE-2024-38657 is an external control of file name vulnerability (CWE-73) affecting Ivanti Connect Secure and Ivanti Policy Secure products. This vulnerability allows a remote authenticated attacker with administrative privileges to write arbitrary files on the target system. While the attack requires prior authentication with admin credentials, successful exploitation could enable an attacker to overwrite critical system files, plant malicious content, or establish persistent access mechanisms on affected appliances.

Critical Impact

Authenticated administrators can write arbitrary files to the system, potentially enabling configuration tampering, backdoor installation, or disruption of VPN gateway services.

Affected Products

• Ivanti Connect Secure versions before 22.7R2.4
• Ivanti Policy Secure versions before 22.7R1.3
• Ivanti Connect Secure version 22.7 through 22.7R2.3

Discovery Timeline

• February 21, 2025 - CVE-2024-38657 published to NVD
• July 9, 2025 - Last updated in NVD database

Technical Details for CVE-2024-38657

Vulnerability Analysis

This vulnerability stems from improper handling of user-controlled file names within the Ivanti Connect Secure and Policy Secure administrative interfaces. The flaw allows an authenticated administrator to manipulate file name parameters, enabling writes to arbitrary locations on the file system. While the requirement for administrative authentication limits the attack surface, compromised admin credentials—whether through phishing, credential stuffing, or other means—could allow threat actors to leverage this vulnerability for malicious purposes.

The network-based attack vector means exploitation can occur remotely over the network without requiring physical access to the appliance. The vulnerability specifically impacts the integrity of the system, as attackers can modify or create files, but does not directly expose confidential data or cause availability issues according to the assessed impact metrics.

Root Cause

The root cause of CVE-2024-38657 is external control of a file name (CWE-73). The application fails to properly validate or sanitize file name input provided by users, allowing attackers to specify arbitrary file paths. When administrative functions accept file name parameters without adequate restrictions, attackers can direct file write operations to sensitive system locations outside the intended directories.

This class of vulnerability typically arises when:

• File paths are constructed using user-supplied input without proper validation
• Path traversal sequences (such as ../) are not filtered or neutralized
• Symbolic link resolution is not properly handled
• Allowlist validation of acceptable file locations is not enforced

Attack Vector

The attack requires network access to the administrative interface of Ivanti Connect Secure or Policy Secure appliances. An attacker must possess valid administrative credentials to exploit this vulnerability. Once authenticated, the attacker can manipulate file name parameters in administrative operations to write files to arbitrary locations on the file system.

Potential attack scenarios include:

• Overwriting configuration files to modify system behavior
• Writing malicious scripts or binaries to establish persistence
• Modifying authentication-related files to create backdoor access
• Planting web shells in accessible directories

Given that Ivanti VPN appliances are critical network infrastructure components, this vulnerability could serve as a foothold for broader network compromise if administrative credentials are obtained through other means.

Detection Methods for CVE-2024-38657

Indicators of Compromise

• Unexpected files appearing in system directories outside normal administrative operations
• Unusual file modification timestamps on critical configuration files
• Evidence of path traversal sequences in web server or application logs
• Administrative session activity from unexpected source IP addresses or at unusual times

Detection Strategies

• Review administrative access logs for unusual file operations or path patterns containing traversal sequences
• Implement file integrity monitoring (FIM) on Ivanti appliances to detect unauthorized file changes
• Monitor for administrative authentication from unexpected network locations or during off-hours
• Deploy network-based detection for suspicious patterns in traffic to Ivanti administrative interfaces

Monitoring Recommendations

• Enable comprehensive logging on Ivanti Connect Secure and Policy Secure appliances
• Configure SIEM alerts for administrative actions involving file operations
• Establish baseline administrative activity patterns and alert on deviations
• Regularly audit administrative user accounts and access permissions

How to Mitigate CVE-2024-38657

Immediate Actions Required

• Upgrade Ivanti Connect Secure to version 22.7R2.4 or later immediately
• Upgrade Ivanti Policy Secure to version 22.7R1.3 or later immediately
• Audit administrative accounts and enforce strong authentication including multi-factor authentication (MFA)
• Review recent administrative activity logs for signs of exploitation

Patch Information

Ivanti has released security patches addressing this vulnerability in the February 2025 security advisory. Administrators should update to the following minimum versions:

• Ivanti Connect Secure: Version 22.7R2.4 or later
• Ivanti Policy Secure: Version 22.7R1.3 or later

For detailed patch information and download links, refer to the Ivanti February Security Advisory.

Workarounds

• Restrict administrative interface access to trusted internal networks only using firewall rules
• Implement network segmentation to limit exposure of management interfaces
• Enable and enforce multi-factor authentication for all administrative accounts
• Review and minimize the number of users with administrative privileges

# Example: Restrict administrative access via firewall (adjust for your environment)
# Block external access to Ivanti admin interface (typically port 443/admin paths)
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.0.0/8 -j DROP

# Alternatively, use ACLs on your network firewall to restrict access
# to the Ivanti management interface to specific administrator workstations