InfoSecBulletin Cybersecurity for mankind
Ivanti has issued a warning regarding two new high-severity vulnerabilities in its Connect Secure and Policy secure solutions, identified as CVE-2024-21888 (CVSS score: 8.8) and CVE-2024-21893 (CVSS score: 8.2) respectively. Furthermore, the company has alerted that one of these vulnerabilities is actively being exploited in the wild.
The vulnerability CVE-2024-21888 allows attackers to gain admin privileges by exploiting a privilege escalation issue in the web component of Ivanti Connect Secure (9.x, 22.x) and Policy Secure (9.x, 22.x).
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
CVE-2023-39780
Botnet hacks thousands of ASUS routers
Bangladesh Bank instructed using AI to prevent online gambling
251 Amazon-Hosted IPs Used in Exploit Scan for ColdFusion, Struts, and Elasticsearch
Zero-Trust Policy bypass to Exploit Vulns & Manipulate NHI Secrets
Evaly E-commerce Platform Allegedly Hacked
CVE-2024-21893 is a server-side request forgery vulnerability in SAML component of Connect Secure (9.x, 22.x), Policy Secure (9.x, 22.x) and Neurons for ZTA. An authenticated attacker can exploit this flaw to access restricted resources.
The company warns that the situation is still changing, and multiple threat actors can quickly adjust their tactics to exploit these issues in their campaigns.
“At the time of publication, the exploitation of CVE-2024-21893 appears to be targeted. Ivanti expects the threat actor to change their behavior and we expect a sharp increase in exploitation once this information is public – similar to what we observed on 11 January following the 10 January disclosure.” reads the advisory.
“Be aware that the situation is still evolving. Ivanti will update this knowledge base article as more information becomes available.”
The software firm suggests using the “mitigation.release.20240126.5.xml” file from the download portal as a temporary solution for CVE-2024-21888 and CVE-2024-21893.
In January 2024, Ivanti reported that hackers were using two new vulnerabilities to run commands on specific gateways.
Today, researchers from cybersecurity company Synacktiv analyzed a Rust malware called KrustyLoader, which was used by threat actors to exploit vulnerabilities.
