Ivanti CPS - RCE (CVE-2024-21887)

CVE-2024-21887 is a command injection vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure, which allows authenticated administrators to execute arbitrary commands on a vulnerable appliance through crafted requests.

CrowdSec has been tracking this vulnerability and its exploits since 18th of January 2024.

CrowdSec network data shows that most actors exploiting CVE-2024-21887 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-21887 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-21887 is currently experiencing high visibility and active exploitation across the internet.

Observed attack attempts frequently involve requests to URLs containing /api/v1/totp/user-backup-code/../../.