{"uuid": "0ba58560-18c2-46cb-9a92-915fd2d89882", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21887", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module chains a server side request forgery (SSRF) vulnerability (CVE-2024-21893) and a command injection\\n          vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti\\n          Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and\\n          22.x are vulnerable, prior to the vendor patch released on Feb 1, 2024. It is unknown if unsupported versions\\n          8.x and below are also vulnerable.\", \"disclosure_date\": \"2024-01-31\", \"fullname\": \"exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"Ivanti Connect Secure Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/ivanti_connect_secure_rce_cve_2024_21893\", \"references\": [\"CVE-2024-21893\", \"CVE-2023-36661\", \"CVE-2024-21887\", \"URL-https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis\", \"URL-https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis\", \"URL-https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure\", \"URL-https://shibboleth.net/community/advisories/secadv_20230612.txt\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:40.027135Z"}