Ivanti Cloud Service Appliance flaw is being actively exploited in the wild

Ivanti warned that recently patched flaw CVE-2024-8190 in Cloud Service Appliance (CSA) is being actively exploited in the wild.

Ivanti warned that a newly patched vulnerability, tracked as CVE-2024-8190 (CVSS score of 7.2), in its Cloud Service Appliance (CSA) is being actively exploited.

“Following public disclosure, Ivanti has confirmed exploitation of this vulnerability in the wild. At the time of this update, we are aware of a limited number of customers who have been exploited.” reads the update provided by the company on September 13, 2024.

An attacker can trigger this high-severity vulnerability to achieve remote code execution under specific conditions.

“An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.” reads the advisory. 

“Successful exploitation could lead to unauthorized access to the device running the CSA. Dual-homed CSA configurations with ETH-0 as an internal network, as recommended by Ivanti, are at a significantly reduced risk of exploitation.”

Ivanti released a security update for Ivanti CSA 4.6 to address the vulnerability.

The company note that CSA 4.6 is End-of-Life, and no longer receives updates for OS or third-party libraries. Customers must upgrade to Ivanti CSA 5.0 for continued support, this version is not impacted by this vulnerability.  

The company did not reveal details about the attacks exploiting the CVE-2024-8190 vulnerability.

Recently cybersecurity firm Horizon3.ai published a technical analysis of an Ivanti Endpoint Manager AgentPortal Deserialization of Untrusted Data issue, tracked as CVE-2024-29847, that could allow remote code execution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cloud Service Appliance)