Critical Command Injection (CVE‑2024‑21887) in Ivanti Connect Secure & Policy Secure Enables Authenticated Code Execution
What It Is — Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure contain a command‑injection flaw (CVE‑2024‑21887) in their web components. An attacker who has a valid administrator account can craft HTTP requests that execute arbitrary operating‑system commands on the appliance.
Exploitability — The vulnerability is exploitable by an authenticated admin; a proof‑of‑concept exists. When chained with CVE‑2023‑46805 (an authentication‑bypass issue), the attack surface widens. CVSS 9.8 (Critical) per NVD.
Affected Products — Ivanti Connect Secure (all supported releases) and Ivanti Policy Secure.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for strict privileged‑access controls and continuous monitoring of admin activity—key evidence for audit readiness.
- Underscores the importance of a timely patch‑management process as a measurable control‑execution signal.
- Tests the robustness of your logging and forensic trail: can you prove that only authorized administrators performed commands?
Recommended Actions
- Deploy Ivanti’s security patch for CVE‑2024‑21887 immediately.
- Enforce multi‑factor authentication and least‑privilege principles for all administrator accounts.
- Enable detailed command‑execution logging and integrate it with a SIEM for real‑time alerting.
Source: CISA KEV – CVE‑2024‑21887