CISA warns Ivanti ICT ineffective for detecting compromises

In a new advisory Thursday, CISA warned that threat actors continue to exploit previously disclosed Ivanti vulnerabilities and that the vendor's internal and external integrity checker tools failed to detect compromises.

Last month, Ivanti issued a series of disclosures for four vulnerabilities, tracked as CVE-2023-46805, CVE-2024-21887, CVE-2024-2204 and CVE-2024-21893, that affect Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) gateways. Exploitation against two of the zero-day flaws, CVE-2023-46805 and CVE-2024-21887, began before patches were available. Volexity, credited for discovery of the two flaws, as well as Mandiant connected activity to a Chinese nation-state actor. CISA separately confirmed reports of exploitation and required Federal Civilian Executive Branch agencies to disconnect all ICS and IPS devices as part of the mitigation steps.

Ivanti repeatedly urged customers to run its external and internal Integrity Checker Tool (ICT). The vendor released an external ICT in January after the internal tool was manipulated by attackers. However, a joint advisory Thursday by CISA and several partnering organizations revealed more problems with the ICT.

"During multiple incident response engagements associated with this activity, CISA identified that Ivanti's internal and previous external ICT failed to detect compromise. In addition, CISA has conducted independent research in a lab environment validating that the Ivanti ICT is not sufficient to detect compromise and that a cyber threat actor may be able to gain root-level persistence despite issuing factory resets," CISA wrote in the advisory.

Investigations revealed attackers exploited the vulnerabilities to gain initial access then deployed web shells and harvested credentials. The attackers then moved laterally and leveraged several tools that are native to Ivanti appliances. In some cases, attacks led to full domain compromise, the advisory warned.

CISA said the web shells deployed by attackers rendered the ICT unreliable for malicious file searches. Attackers also manipulated the ICT by returning the appliance to a "clean state" to obfuscate their tracks.

CISA's forensic analysis follows previous problems with the ICT that Ivanti highlighted last month. In a security advisory for CVE-2023-46805 and CVE-2024-21887, Ivanti confirmed it observed threat actors "attempting to manipulate" the internal ICT. Ivanti urged customers to run the external tool, which was updated with a new feature, instead.

However, CISA's advisory Thursday said the ICT is ineffective, based on incident response investigations and the agency's own research. "Leveraging these vulnerabilities, CISA researchers were able to exfiltrate domain administrator cleartext credentials, gain root-level persistence, and bypass integrity checks used by the integrity checker application," the advisory read.

Now, CISA is asking ICS and IPS customers to weigh the risks of running the products in their environments.

"The authoring organizations strongly urge all organizations to consider the significant risk of adversary access to, and persistence on, Ivanti Connect Secure and Ivanti Policy Secure gateways when determining whether to continue operating these devices in an enterprise environment," the advisory read.

Editor's note: Emphasis by CISA.