# CVE-2024-22024: Ivanti - XXE

> Live exploitation tracking for CVE-2024-22024 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-22024

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 8.3
- **Public exploit available:** Yes
- **Affected products:** Ivanti Ips
- **Weaknesses:** CWE-611 (Improper Restriction of XML External Entity Reference)
- **Tags:** enterprise_software, sslvpn

## Description

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

## CrowdSec analysis

[CVE-2024-22024](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-22024) is an XML external entity (XXE) vulnerability affecting the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways. Successful exploitation allows attackers to access restricted resources without authentication, posing a risk to the confidentiality of sensitive data.

CrowdSec has been tracking this vulnerability and its exploits since 26th of March 2024.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-22024 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-22024 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-22024 is currently experiencing high visibility and active exploitation across the internet.

Observed exploitation attempts often target the endpoint at `dana-na/auth/saml-sso.cgi`

## Timeline

- 2024-02-13: CVE Published. CVE-2024-22024 is published to NVD.
- 2024-03-26: Rule Released. CrowdSec releases a rule to detect CVE-2024-22024 exploitation attempts against the CrowdSec Network.
- 2024-11-26: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-22024 for the first time.

## References

- https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22024.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-22024) follows observed exploitation activity for CVE-2024-22024. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.