Description
Ivanti Cloud Services Appliance（CSA）是一款由Ivanti公司提供的云服务设备，旨在为企业提供安全的远程访问和云服务管理。Ivanti CSA 4.6 Patch 519之前的版本存在路径遍历漏洞。远程未认证攻击者可以利用此漏洞访问受限功能，可能导致敏感信息泄露或权限提升。
Ivanti CSA /client/index.php%3F.php 目录遍历漏洞 （CVE-2024-8963）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-8963
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963
https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa
https://harfanglab.io/insidethelab/insights-ivanti-csa-exploitation/
https://www.ic3.gov/CSA/2025/250122.pdf
https://www.cve.org/CVERecord?id=CVE-2024-8963
https://www.acunetix.com/vulnerabilities/web/ivanti-csa-path-traversal-cve-2024-8963-cve-2024-8190/
https://www.broadcom.com/support/security-center/protection-bulletin/cve-2024-8963-path-traversal-vulnerability-in-ivanti-csa
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8963.yaml
https://www.tenable.com/cve/CVE-2024-8963