Ivanti Connect Secure Zero-Days Chained for Unauthenticated Compromise

Summary

An unknown threat actor tracked as UTA0576 exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root-level code execution. The attack combined an authentication bypass, remote code execution through a race condition, and privilege escalation. The actor primarily focused on credential theft involving Active Directory, LAPS, and BitLocker recovery keys.

Investigation

Volexity identified the compromise through network security monitoring and performed a forensic investigation using memory and disk imaging. Because the attacker relied on in-memory patching and deleted logs, researchers used the Volcano platform to reconstruct the exploit chain from core dumps and system memory. The investigation also showed that HTTPS requests were used as a command channel instead of traditional C2 infrastructure.

Mitigation

Organizations should immediately apply Ivanti patches addressing the authentication bypass and RCE vulnerabilities. Security teams should monitor for unusual X-DSCGI-PATH headers and high volumes of requests to /dana-na/auth/url_default/welcome.cgi. Running the Ivanti Integrity Checker and upgrading affected appliances to non-vulnerable releases are also strongly recommended.

Response

When suspicious activity is detected, organizations should conduct forensic investigations of ICS VPN appliances, with particular attention to evidence of lateral movement. Memory forensics is highly recommended because much of the exploit chain operates in memory and leaves limited on-disk artifacts. Review the /tmp/ directory for unauthorized scripts and inspect audit logs for signs of tampering.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to exploit the Ivanti Connect Secure vulnerability by simulating the access of a known malicious CGI endpoint used in the exploit chain. After accessing the path /home/webserver/htdocs/dana/fb/smb/wu.cgi, the attacker attempts to stage a web shell or a post-exploitation toolkit by writing a file into the specific directory /home/runtime/tmp/. This mimics the unauthenticated remote code execution and subsequent file manipulation observed in the real-world zero-day exploitation.

• Regression Test Script:

  #!/bin/bash
  # Simulation script for Ivanti Connect Secure Exploit Detection
  
  # 1. Setup: Create the directory structure required for the simulation
  echo "[+] Setting up simulation environment..."
  sudo mkdir -p /home/webserver/htdocs/dana/fb/smb/
  sudo mkdir -p /home/runtime/tmp/
  
  # 2. Create the "malicious" CGI file
  echo "[+] Creating malicious CGI file..."
  sudo touch /home/webserver/htdocs/dana/fb/smb/wu.cgi
  sudo chmod 777 /home/webserver/htdocs/dana/fb/smb/wu.cgi
  
  # 3. Simulate the exploitation: Accessing the file (triggers selection_paths)
  echo "[+] Simulating access to malicious CGI path..."
  cat /home/webserver/htdocs/dana/fb/smb/wu.cgi > /dev/null
  
  # 4. Simulate payload staging (triggers selection_tmp)
  echo "[+] Simulating payload drop in /home/runtime/tmp/..."
  echo "<?php system($_GET['cmd']); ?>" | sudo tee /home/runtime/tmp/shell.php > /dev/null
  
  echo "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  #!/bin/bash
  # Cleanup script to remove simulation artifacts
  
  echo "[+] Cleaning up simulation artifacts..."
  sudo rm -f /home/webserver/htdocs/dana/fb/smb/wu.cgi
  sudo rm -f /home/runtime/tmp/shell.php
  sudo rmdir /home/webserver/htdocs/dana/fb/smb/ 2>/dev/null
  sudo rmdir /home/webserver/htdocs/dana/fb/ 2>/dev/null
  sudo rmdir /home/webserver/htdocs/dana/ 2>/dev/null
  sudo rmdir /home/webserver/htdocs/ 2>/dev/null
  sudo rmdir /home/webserver/ 2>/dev/null
  sudo rmdir /home/runtime/tmp/ 2>/dev/null
  sudo rmdir /home/runtime/ 2>/dev/null
  
  echo "[+] Cleanup finished."