Critical SSRF in Ivanti Connect Secure, Policy Secure, and Neurons (CVE‑2024‑21893) Enables Unauthenticated Access
What It Is — A server‑side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (formerly Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons. The flaw lets an attacker cause the appliance to issue arbitrary HTTP requests to internal services without authentication.
Exploitability — Proof‑of‑concept code is publicly available; no confirmed wild‑use exploits yet. CVSS v3.1 base score 8.8 (High).
Affected Products — Ivanti Connect Secure, Ivanti Policy Secure, Ivanti Neurons (all versions prior to the March 2024 security patch).
Why It Matters for Trust & Control Assurance
- Continuous verification of authentication pathways is a core control objective; an SSRF bypass directly undermines that assurance.
- Demonstrable, auditable configuration evidence (hardened SAML settings, outbound request restrictions) is now a prerequisite for many enterprise security reviews.
- Unchecked remote‑access gateways create a blind spot in supply‑chain risk posture that regulators and customers increasingly scrutinize.
Recommended Actions
- Deploy Ivanti’s security update for CVE‑2024‑21893 immediately.
- Review and harden SAML endpoint configurations; restrict the appliance’s ability to initiate outbound connections to only trusted destinations.
- Enable detailed request logging and integrate logs into a SIEM for continuous monitoring.
- Map the remediation to your secure‑configuration control objective and capture evidence for audit readiness.
Source: CISA KEV – CVE‑2024‑21893