CVE-2024-39712: Ivanti Connect Secure RCE Vulnerability

CVE-2024-39712 Overview

CVE-2024-39712 is an argument injection vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure. The flaw enables a remote authenticated attacker with administrative privileges to achieve remote code execution on the affected appliance. Ivanti addressed the issue in Connect Secure versions 22.7R2.1 and 9.1R18.7, and in Policy Secure version 22.7R1.1. The weakness is categorized as Improper Neutralization of Argument Delimiters in a Command [CWE-88].

Critical Impact

An authenticated administrator can inject arguments into a system command, escape the intended context, and execute arbitrary code on the gateway. Compromise of Connect Secure or Policy Secure gives attackers a foothold at the network perimeter.

Affected Products

• Ivanti Connect Secure before 22.7R2.1
• Ivanti Connect Secure 9.x before 9.1R18.7
• Ivanti Policy Secure before 22.7R1.1

Discovery Timeline

• 2024-11-13 - CVE-2024-39712 published to NVD
• 2025-07-11 - Last updated in NVD database

Technical Details for CVE-2024-39712

Vulnerability Analysis

The vulnerability is an argument injection flaw [CWE-88] in administrative functionality exposed by Ivanti Connect Secure and Policy Secure. An attacker who already holds admin credentials can submit crafted input that is passed to a downstream command without proper neutralization of argument delimiters. The injected arguments alter the behavior of the underlying command and lead to execution of attacker-controlled code on the appliance.

Because Connect Secure and Policy Secure operate as VPN and network access control gateways, code execution on these devices typically provides access to traffic, credentials, and internal network reachability. Exploitation does not require user interaction, and the impact crosses a security boundary, affecting components beyond the vulnerable process.

Root Cause

The root cause is insufficient sanitization of user-supplied parameters that are concatenated into a command line. The application accepts input containing delimiter characters or leading dashes that the target command interprets as additional options or operands. This allows the attacker to inject crafted arguments that change the command's behavior and reach an execution sink.

Attack Vector

Exploitation is performed over the network against the management interface. The attacker must authenticate as an administrator, then submit a specially crafted request to the vulnerable endpoint. The injected arguments are passed to the underlying utility, producing remote code execution in the context of the appliance service account. No specific code example has been published by Ivanti or third parties at the time of writing; consult the Ivanti Security Advisory for additional technical details.

Detection Methods for CVE-2024-39712

Indicators of Compromise

• Administrative web requests containing argument delimiters such as --, backticks, $(), or unexpected flag-style tokens in parameter values.
• New or unscheduled child processes spawned by Connect Secure or Policy Secure web service components.
• Outbound connections from the appliance to unfamiliar IP addresses shortly after administrative authentication events.
• Unexpected modifications to configuration files or scheduled tasks on the gateway.

Detection Strategies

• Correlate successful administrator logins with subsequent command-execution telemetry on the appliance.
• Inspect web access logs for requests to administrative endpoints that include shell metacharacters or argument-style payloads.
• Alert on process lineage where Ivanti web service binaries invoke shells or system utilities outside of normal patterns.

Monitoring Recommendations

• Forward Connect Secure and Policy Secure system, audit, and web logs to a centralized SIEM for retention and analytics.
• Restrict and continuously monitor source IPs that can reach the administrative interface.
• Review administrator account inventory and credential hygiene, including multi-factor authentication enforcement.

How to Mitigate CVE-2024-39712

Immediate Actions Required

• Upgrade Ivanti Connect Secure to 22.7R2.1 or 9.1R18.7, and Ivanti Policy Secure to 22.7R1.1 or later.
• Limit administrative web interface exposure to a dedicated management network or jump host.
• Rotate administrator credentials and review audit logs for unexplained admin activity prior to patching.
• Validate appliance integrity using Ivanti's Integrity Checker Tool after upgrade.

Patch Information

Ivanti has released fixed builds for both product families. Apply Connect Secure 22.7R2.1 (and 9.1R18.7 for the 9.x train) and Policy Secure 22.7R1.1. Refer to the Ivanti Security Advisory for the complete list of CVEs addressed and upgrade guidance.

Workarounds

• Restrict access to the administrative interface to trusted management subnets using network ACLs.
• Enforce multi-factor authentication on all administrative accounts to raise the bar for the required privilege.
• Disable or remove unused administrative accounts, and audit existing role assignments for least privilege.

# Example: restrict access to the Ivanti admin interface to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP