Ivanti - XXE (CVE-2024-22024)
Description
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
psychologyCrowdSec Analysis
CVE-2024-22024 is an XML external entity (XXE) vulnerability affecting the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways. Successful exploitation allows attackers to access restricted resources without authentication, posing a risk to the confidentiality of sensitive data.
CrowdSec has been tracking this vulnerability and its exploits since 26th of March 2024.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-22024 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-22024 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-22024 is currently experiencing high visibility and active exploitation across the internet.
Observed exploitation attempts often target the endpoint at dana-na/auth/saml-sso.cgi
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-02-13 |
| Rule Released | 2024-03-26 |
| CrowdSec First Seen | 2024-11-26 |