Ivanti Connect Secure: Auth Bypass to Webshell

The VPN appliance has started behaving in ways that a VPN appliance should not. Before tracing what the intruder did inside, establish how they reached the appliance in the first place without a valid user session.

Reading unauthenticated data from an API is serious. Running commands on the box is a different order of magnitude. Determine whether that line was crossed and identify the process evidence that confirms it.

Exploitation confirmed code execution. The operator then used that access to install something that would survive independently. Find the file path where the webshell was written.

Once the webshell was live, a different external IP started driving commands. One of those commands read a sensitive file from the appliance. Identify the file that was read.

After the credential collection phase, the implant established a persistent connection back to attacker infrastructure. Determine where it was calling home.

The attacker did not stop at the DMZ appliance. Credentials harvested from the configuration file were used to authenticate somewhere inside. Determine the internal system that was reached and the account used.

Map the combined CVE-2023-46805 and CVE-2024-21887 exploit chain to its MITRE ATT&CK technique identifier. The technique describes exploiting a vulnerability in a public-facing application to gain initial access.