CVE-2025-55147: Ivanti Connect Secure CSRF Vulnerability

CVE-2025-55147 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple Ivanti products including Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. This vulnerability allows a remote unauthenticated attacker to execute sensitive actions on behalf of an authenticated victim user. The attack requires user interaction, typically through social engineering tactics that trick the victim into clicking a malicious link or visiting a crafted webpage while authenticated to the vulnerable Ivanti appliance.

Critical Impact

Remote unauthenticated attackers can hijack authenticated user sessions to perform sensitive administrative actions, potentially compromising VPN access controls and secure access infrastructure.

Affected Products

• Ivanti Connect Secure before 22.7R2.9 or 22.8R2
• Ivanti Policy Secure before 22.7R1.6
• Ivanti ZTA Gateway before 2.8R2.3-723
• Ivanti Neurons for Secure Access before 22.8R1.4

Discovery Timeline

• September 9, 2025 - CVE-2025-55147 published to NVD
• September 24, 2025 - Last updated in NVD database

Technical Details for CVE-2025-55147

Vulnerability Analysis

This CSRF vulnerability (CWE-352) exists due to the lack of proper anti-CSRF token validation in sensitive web interface operations across multiple Ivanti secure access products. When an authenticated administrator or user visits a malicious webpage crafted by an attacker, their browser can be induced to send authenticated requests to the vulnerable Ivanti appliance without the user's knowledge or consent.

The affected products are critical network infrastructure components used for VPN access, policy enforcement, and zero trust network access. Successful exploitation could allow an attacker to modify security policies, create backdoor accounts, alter VPN configurations, or perform other administrative actions with the privileges of the victim user.

Root Cause

The vulnerability stems from insufficient validation of request origin and the absence or improper implementation of anti-CSRF tokens in sensitive state-changing operations within the web management interface. The application fails to verify that requests originate from legitimate user interactions within the authenticated session, allowing forged cross-origin requests to be processed as legitimate administrative commands.

Attack Vector

The attack requires network access and user interaction. An attacker must craft a malicious webpage or email containing embedded requests targeting the vulnerable Ivanti appliance. When an authenticated user with administrative privileges visits this malicious content while logged into the Ivanti management interface, their browser automatically includes session cookies with the forged request. The server processes this request as if it were a legitimate user action, executing sensitive operations such as configuration changes, user account modifications, or policy alterations without proper authorization verification.

A typical attack scenario involves embedding hidden form submissions or JavaScript-driven requests within a malicious webpage that targets known administrative endpoints on the Ivanti appliance. Since the victim's browser automatically attaches valid session credentials, the forged request bypasses authentication but exploits the missing CSRF protections.

Detection Methods for CVE-2025-55147

Indicators of Compromise

• Unexpected configuration changes in Ivanti Connect Secure, Policy Secure, ZTA Gateway, or Neurons for Secure Access appliances
• Administrative actions logged from unusual source IP addresses or at unusual times
• New user accounts or modified access policies that were not authorized by administrators
• Referrer headers in web logs showing requests to sensitive endpoints originating from external domains

Detection Strategies

• Monitor administrative audit logs for configuration changes that lack corresponding authorized change requests
• Analyze web server logs for requests to administrative endpoints with suspicious or missing referrer headers
• Implement network monitoring to detect unusual patterns of administrative API calls
• Configure alerting for bulk configuration changes or creation of privileged accounts outside normal maintenance windows

Monitoring Recommendations

• Enable verbose logging on all affected Ivanti appliances and forward logs to a centralized SIEM solution
• Set up real-time alerts for administrative actions performed during off-hours or from unexpected locations
• Regularly review authentication logs for sessions that may have been compromised
• Monitor network traffic for connections to known phishing or malicious domains from administrator workstations

How to Mitigate CVE-2025-55147

Immediate Actions Required

• Update Ivanti Connect Secure to version 22.7R2.9 or 22.8R2 or later
• Update Ivanti Policy Secure to version 22.7R1.6 or later
• Update Ivanti ZTA Gateway to version 2.8R2.3-723 or later
• Update Ivanti Neurons for Secure Access to version 22.8R1.4 or later
• Review recent administrative changes and audit logs for signs of compromise

Patch Information

Ivanti has released security updates addressing this CSRF vulnerability as part of their September 2025 Security Advisory. Organizations should consult the Ivanti Security Advisory for detailed upgrade instructions and download links for patched firmware versions. For Ivanti Neurons for Secure Access, the fix was deployed on August 2, 2025, as a cloud-based update.

Workarounds

• Implement strict network segmentation to limit administrative interface access to trusted management networks only
• Require administrators to use dedicated browsers or browser profiles exclusively for Ivanti appliance management
• Train administrators to avoid clicking untrusted links or browsing external websites while authenticated to administrative interfaces
• Consider implementing additional access controls such as multi-factor authentication for administrative sessions

# Example network segmentation configuration
# Restrict management interface access to trusted admin network
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP