Ivanti CPS - RCE (CVE-2024-21887)

CVE-2024-21887 is a command injection vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure, which allows authenticated administrators to execute arbitrary commands on a vulnerable appliance through crafted requests.

CrowdSec has been tracking this vulnerability and its exploits since 18th of January 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-21887 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2024-21887 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2024-21887 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Observed attack attempts frequently involve requests to URLs containing /api/v1/totp/user-backup-code/../../.