Ivanti warns of three new actively Exploited flaws in Cloud Service Application

Ivanti has issued an alert about three newly discovered zero-day vulnerabilities affecting its Cloud Services Appliance (CSA), which are currently being exploited in the wild. These vulnerabilities, tracked as CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381, can be used in conjunction with CVE-2024-8963, a critical flaw patched in September 2024, to compromise vulnerable systems.

Ivanti has identified exploitation in a limited number of customers using CSA 4.6 patch 518 and earlier. There is no evidence of exploitation against environments running CSA version 5.0 or later.

Overview of the Vulnerabilities:

• CVE-2024-9380 (CVSS score 7.2) - OS Command Injection Vulnerability - An operating system command injection vulnerability that allows a remote authenticated attacker with administrative privileges to achieve remote code execution through the admin web console in Ivanti CSA before version 5.0.2. This could enable attackers to execute arbitrary commands on the affected systems, potentially leading to a complete system compromise.

• CVE-2024-9381 (CVSS score 7.2) - Path Traversal Vulnerability - A path traversal vulnerability that enables a remote authenticated attacker with admin privileges to bypass security restrictions in Ivanti CSA before version 5.0.2. This flaw can allow access to restricted directories or files, potentially exposing sensitive information.

• CVE-2024-9379 (CVSS score 6.5) - SQL Injection Vulnerability - This flaw allows a remote authenticated attacker with administrative privileges to execute arbitrary SQL statements through the admin web console in Ivanti CSA before version 5.0.2. An attacker could manipulate SQL databases, potentially altering or retrieving sensitive information.

Attackers are using CVE-2024-8963 which was patched in September in combination with the new vulnerabilities to execute sophisticated exploits.

Ivanti advises all customers to immediately update their CSA appliances to version 5.0.2, as it mitigates the identified vulnerabilities.