Breaking Down the Ivanti CSA Vulnerabilities: Lessons for Cyber Resilience • Sylvan Ravinet

On January 22, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI released a critical advisory detailing how sophisticated threat actors exploited vulnerabilities in Ivanti Cloud Service Appliances (CSA). The French National Cybersecurity Agency (ANSSI) through its CERT-FR also provided, in October 2024, critical insights into the attack patterns and specific indicators of compromise.

Why This Is Important

These attacks—leveraging zero-day vulnerabilities—underscore the ever-evolving nature of cyber threats and the importance of robust security practices, both for any company or organization and for the software vendors, particularly from the security industry.

As a CISO, I want to take a moment to unpack what happened, why it matters, and, most importantly, what actionable steps organizations can take to bolster their defenses.

Executive Summary

The Ivanti CSA security incidents represents a critical turning point in how we approach cybersecurity. Here are the key implications for organizational leaders:

End-of-Life Systems Risk: Organizations running EOL software faced disproportionate impact, highlighting the need for proper lifecycle management.
Zero-Day Impact: The attack demonstrated how zero-day vulnerabilities can bypass traditional security measures.
Detection Speed Matters: Organizations with robust monitoring detected the attack early, significantly limiting damage.
Supply Chain Vulnerability: The incident shows how compromised infrastructure tools, particularly if cybersecurity tools, can affect entire organizations.
Proactive Defense Works: Companies with layered and complementary security approaches were better positioned to detect and respond.

Historical Context: A Pattern of Zero-Day Vulnerabilities

Over the past 4 months, Ivanti’s CSA product has been repeatedly targeted through zero-day vulnerabilities, establishing a concerning pattern:

September 2024 Wave

CVE-2024-8190: OS command injection (High severity)
CVE-2024-8963: Critical path traversal vulnerability
Both actively exploited as zero-days before patches were released

October 2024 Campaign

CVE-2024-9379: SQL injection in admin console
CVE-2024-9380: OS command injection vulnerability
CVE-2024-9381: Path traversal vulnerability
All three vulnerabilities were actively exploited before patches

This pattern of repeated zero-day discoveries and exploitations raises important questions about:

Supply chain security in cybersecurity products
The effectiveness of current vulnerability management practices
The need for more robust security testing and validation

Technical Analysis

Attack Overview

Before diving into the details, let’s look at a high-level overview of the attack:

		flowchart TD
    subgraph Initial ["Initial Access Tools"]
        A1["Obelisk Scanner"]:::tool
        A2["GoGo Scanner"]:::tool
    end

    subgraph Vulns ["Vulnerability Chains"]
        Chain1["CVE-2024-8963
        CVE-2024-8190
        CVE-2024-9380"]:::vuln
        Chain2["CVE-2024-8963
        CVE-2024-9379"]:::vuln
    end

    subgraph Execution ["Attack Execution"]
        Exec["Base64 Encoded
        Python Scripts"]:::attack
    end

    A1 & A2 --> Chain1 & Chain2
    Chain1 & Chain2 --> Exec

    subgraph Post ["Post Exploitation"]
        Persist["Persistence
        <hr>
        Webshells &
        Modified Files"]:::file
        
        Lateral["Lateral Movement
        <hr>
        Jenkins
        Exploitation"]:::attack
        
        C2["Command & Control
        <hr>
        142.171.217.195
        154.64.226.166"]:::ioc
    end

    Exec --> Persist --> Lateral --> C2

    %% Style definitions
    classDef vuln fill:#FF6B6B,stroke:#FF0000,color:white
    classDef tool fill:#4ECDC4,stroke:#45B7AF,color:black
    classDef attack fill:#FF9F1C,stroke:#F4900C,color:black
    classDef file fill:#A8E6CF,stroke:#8CD4B4,color:black
    classDef ioc fill:#FFD93D,stroke:#FFC107,color:black
    classDef defense fill:#95A5A6,stroke:#7F8C8D,color:white
    classDef default fill:#f9f9f9,stroke:#999,color:black

Critical Vulnerabilities Deep Dive

In September 2024, advanced threat actors exploited multiple vulnerabilities in Ivanti CSA versions 4.6x (end-of-life) and 5.0.1 (and below). The attack leveraged a sophisticated chain of vulnerabilities:

CVE-2024-8963 (Administrative Bypass)
- Severity: Critical (CVSS 9.8)
- The vulnerability exploits a flaw in the authentication mechanism where specially crafted HTTP requests could bypass security controls
- Attackers could access administrative interfaces without valid credentials
- Impact: Complete authentication bypass leading to unauthorized administrative access
CVE-2024-8190 (OS Command Injection)
- Severity: Critical (CVSS 9.5)
- Exploitable through malformed input in the system configuration interface
- Allows execution of arbitrary system commands with root privileges
- Impact: Complete system compromise through remote code execution
CVE-2024-9379 (SQL Injection)
- Severity: Critical (CVSS 9.1)
- Vulnerability in the user management interface allows manipulation of SQL queries
- Attackers could extract sensitive data and modify database contents
- Impact: Unauthorized access to user credentials and sensitive system data
CVE-2024-9380 (Command Injection)
- Severity: High (CVSS 8.8)
- Exploitable through the system logging functionality
- Enables privilege escalation through crafted log entries
- Impact: Elevation to root privileges and persistent system access

Attack Chain & Timeline

Attack Chain Analysis

Let’s examine how the attackers chained these vulnerabilities together to achieve their objectives:

		graph TD
    %% Initial Attack Stages - Red tones for active attack phases
    A[Reconnaissance]:::recon --> B[Active Scanning - T1595.002]:::recon
    C[Initial Access]:::critical --> D[Exploit Public-Facing Application - T1190]:::critical
    E[Execution]:::critical --> F[Command and Scripting Interpreter - T1059]:::critical
    E --> Q[Credential Access - T1552.001]:::critical

    %% Persistence and Privilege - Orange tones for establishment
    G[Persistence]:::establish --> H[Web Shell - T1505.003]:::establish
    G --> J[Modify Authentication Process - T1556]:::establish
    K[Privilege Escalation]:::establish --> L[Exploitation for Privilege Escalation - T1068]:::establish

    %% Defense Evasion - Purple for stealth
    M[Defense Evasion]:::stealth --> N[Hidden Users - T1564.002]:::stealth
    M --> O[Decode Files or Information - T1140]:::stealth
    M --> P[Abuse Elevation Control Mechanism - Sudo - T1548.003]:::stealth

    %% Lateral Movement and C2 - Blue for network activities
    Q --> S[Lateral Movement - T1210]:::network
    S --> T[Exploitation of Remote Services - T1210]:::network
    U[Command and Control]:::network --> V[Remote Access Software - T1219]:::network
    U --> W[Application Layer Protocol - Web Protocol - T1071.001]:::network

    %% Data Theft - Yellow for data-focused activities
    Q --> X[Exfiltration - TA0010]:::data
    X --> Y[Exfiltration of Credentials - TA0010]:::data

    %% Core Attack Path
    A --> C
    C --> E
    E --> G
    E --> K
    G --> M
    K --> S
    S --> U
    U --> X

    classDef recon fill:#FFB6C1,stroke:#FF0000,color:black
    classDef critical fill:#FF0000,stroke:#8B0000,color:white
    classDef establish fill:#FFA500,stroke:#FF8C00,color:black
    classDef stealth fill:#9370DB,stroke:#483D8B,color:white
    classDef network fill:#4169E1,stroke:#000080,color:white
    classDef data fill:#FFD700,stroke:#DAA520,color:black

Comprehensive Timeline

This detailed timeline shows the complete progression of the attack, including timing and technical details:

		flowchart LR
    %% Timeline nodes at the top
    T1["September 2024"]:::note
    T2["Zero-day exploitation<br/>Sep-Oct 2024"]:::note
    T3["Within minutes"]:::note
    T4["Within hours"]:::note
    T5["Same day"]:::note

    %% Main attack flow
    subgraph Recon["Reconnaissance"]
        direction TB
        A1["Obelisk<br/>Scanner"]:::attacker
        A2["GoGo<br/>Scanner"]:::attacker
    end

    subgraph Initial["Initial Access"]
        direction TB
        subgraph Chain1["Chain 1"]
            direction TB
            B1["CVE-2024-8963<br/>Admin Bypass"]:::attacker --> 
            B3["CVE-2024-8190<br/>Command Injection"]:::attacker --> 
            B4["CVE-2024-9380<br/>Command Injection"]:::attacker
        end
        
        subgraph Chain2["Chain 2"]
            direction TB
            B5["CVE-2024-8963"]:::attacker --> 
            B2["CVE-2024-9379<br/>SQL Injection"]:::attacker
        end
    end

    subgraph Execution["Execution"]
        direction TB
        E1["Base64 Scripts<br/>Credential Harvest"]:::attacker
    end

    subgraph Persist["Persistence"]
        direction TB
        P1["Webshells<br/>help.php, view.php"]:::attacker
        P2["File<br/>Modifications"]:::attacker
    end

    subgraph Movement["Lateral Movement"]
        direction TB
        L1["Jenkins<br/>Exploitation"]:::attacker
        L2["VPN Login<br/>Attempts"]:::attacker
        L3["Postgres<br/>Exploitation"]:::attacker
    end

    subgraph Control["C2"]
        direction TB
        C2_1["142.171.217.195"]:::ioc
        C2_2["154.64.226.166"]:::ioc
    end

    subgraph Exfil["Exfiltration"]
        direction TB
        Ex1["Admin<br/>Credentials"]:::attacker
    end

    %% Timeline connections
    T1 -.-> Recon
    T2 -.-> Initial
    T3 -.-> Execution
    T4 -.-> Persist
    T5 -.-> Movement

    %% Main flow connections
    Recon --> Initial
    Chain1 & Chain2 --> Execution
    Execution --> Persist
    Persist --> Movement
    Movement --> Control
    Control --> Exfil
    
    %% Additional tactical connections
    Execution --> Exfil
    Movement --> Exfil

    %% Styling
    classDef attacker fill:#FF4040,stroke:#8B0000,color:white
    classDef defender fill:#4169E1,stroke:#00008B,color:white
    classDef ioc fill:#FFD700,stroke:#B8860B,color:black
    classDef note fill:#FFFFCC,stroke:#999900,color:black
    %% Optional: Add a title
    title[" Comprehensive Attack Flow with Timeline"]:::note
    style title fill:#fff,stroke:none

Attack Phases

Initial Compromise

Attackers used automated scanning tools (Obelisk and GoGo Scanner) to identify vulnerable Ivanti CSA instances
Initial access achieved through CVE-2024-8963, bypassing authentication controls
Exploitation typically occurred during off-hours to avoid detection

Execution Phase

Attackers deployed Base64-encoded Python scripts for credential harvesting
The malicious scripts targeted specific system files containing encrypted credentials
Custom-built tools were used to decrypt harvested credentials offline

Persistence Mechanisms

Multiple webshells were deployed (help.php, view.php) in non-standard directories
Webshells were disguised as legitimate system files
Modified system binaries to ensure persistence across reboots

Lateral Movement

Compromised Jenkins servers through harvested credentials
Exploited PostgreSQL databases using elevated privileges
VPN access attempts using stolen credentials

Threat Actor Analysis

MITRE ATT&CK Framework Mapping

1. Reconnaissance (TA0043)

T1595.002: Active Scanning
- Tools: Obelisk and GoGo Scanner
- Target: Vulnerable Ivanti CSA instances

2. Initial Access (TA0001)

T1190: Exploit Public-Facing Application
- Vulnerability chaining
- Authentication bypass techniques

3. Execution (TA0002)

T1059: Command and Scripting Interpreter
```
# Basic example of encoded payload structure
import base64
payload = base64.b64encode(b'[malicious_code]')
```

4. Persistence (TA0003)

T1505.003: Web Shell Implementation
- Deployed files: help.php, view.php
- Modified authentication processes

Defense & Mitigation

Immediate Actions for Organizations

Audit Your Environment
- Identify and replace EOL systems
- Review access controls and authentication mechanisms
- Assess critical system exposure
Strengthen Monitoring
- Implement comprehensive logging
- Deploy advanced threat detection
- Enable real-time alerting
Enhance Response Capabilities
- Update incident response plans
- Conduct tabletop exercises
- Establish clear communication channels

Defense Strategy Mapping

For a deeper technical understanding, this diagram shows how defender’s actions can deny, contain, detect or purge the attackers:

		flowchart TD
    %% Attackers Path
    subgraph Recon[Reconnaissance - TA0043]
        A1[Obelisk Scanner]:::attacker
        A2[GoGo Scanner]:::attacker
    end
    note1[September 2024]:::note
    Recon --- note1
    Recon --> Chain1
    Recon --> Chain2

    subgraph Initial[Initial Access - TA0001]
        subgraph Chain1[Chain 1]
            B1[CVE-2024-8963]:::attacker --> 
            B3[CVE-2024-8190]:::attacker --> 
            B4[CVE-2024-9380]:::attacker
        end
        subgraph Chain2[Chain 2]
            B5[CVE-2024-8963]:::attacker --> 
            B2[CVE-2024-9379]:::attacker
        end
    end
    note2[Zero-day exploitation<br>Sep-Oct 2024]:::note
    Initial --- note2
    Chain1 --> Exec
    Chain2 --> Exec
    
    subgraph Exec[Execution - TA0002]
        E1[Base64 Scripts - Credential Harvest]:::attacker
    end
    note3[Within minutes<br>of initial access]:::note
    Exec --- note3
    Exec --> Persist
    Exec --> Exfil
    
    subgraph Persist[Persistence - TA0003]
        P1[Webshells]:::attacker
        P2[File Modifications]:::attacker
    end
    note4[Within hours]:::note
    Persist --- note4
    Persist --> Lateral
    
    subgraph Lateral[Lateral Movement - TA0008]
        L1[Jenkins Exploitation]:::attacker
        L2[Postgres Exploitation]:::attacker
    end
    note5[Same day]:::note
    Lateral --- note5
    Lateral --> C2
    
    subgraph C2[Command and Control]
        C2_1[142.171.217.195]:::ioc
        C2_2[154.64.226.166]:::ioc
    end
    C2 --> Exfil
    
    subgraph Exfil[Exfiltration - TA0010]
        Ex1[Admin Credentials]:::attacker
    end

    %% Defenders Path
    subgraph Defense[MITRE DEFEND Response]
        subgraph Detection[Detection]
            D1[Process Monitoring<br>DS0017]:::defender
            D2[Log Review<br>DS0022]:::defender
            D3[File Monitoring<br>DS0015]:::defender
        end
        subgraph Mitigation[Mitigation]
            M1[Reimage Hosts<br>DM0006]:::defender
            M2[Change Accounts<br>DM0009]:::defender
            M3[Software Update<br>DM0022]:::defender
        end
        subgraph Hunt[Threat Hunting]
            H1[IOC Analysis<br>DS0016]:::defender
            H2[Share Intel<br>DM0020]:::defender
        end
    end
    
    %% Defense Connections
    Detection -.-> Initial
    Detection -.-> Exec
    Detection -.-> Persist
    Mitigation -.-> Lateral
    Hunt -.-> C2

    classDef attacker fill:#FF4040,stroke:#8B0000,color:white
    classDef defender fill:#4169E1,stroke:#00008B,color:white
    classDef ioc fill:#FFD700,stroke:#B8860B,color:black
    classDef note fill:#FFFFCC,stroke:#999900,color:black

The following diagram shows how defensive measures interact with the attack progression - and detect or block it:

		flowchart TB
    %% Attacker Flow - Left Side
    Recon[Reconnaissance - TA0043]:::attacker --> Initial
    Initial[Initial Access - TA0001]:::attacker --> Exec
    Exec[Execution - TA0002]:::attacker --> Persist
    Persist[Persistence - TA0003]:::attacker --> Lateral
    Lateral[Lateral Movement - TA0008]:::attacker --> C2
    C2[Command & Control]:::attacker --> Exfil
    Exfil[Exfiltration - TA0010]:::attacker
    
    %% Defender Flow - Right Side
    DS0017[Process Monitoring<br>DS0017]:::defender --> DS0022
    DS0022[Log Review<br>DS0022]:::defender --> DS0015
    DS0015[File Monitoring<br>DS0015]:::defender --> DS0016
    DS0016[Threat Hunting<br>DS0016]:::defender --> DM0006
    DM0006[Reimage Hosts<br>DM0006]:::defender --> DM0009
    DM0009[Reset Credentials<br>DM0009]:::defender --> DM0022
    DM0022[Patch Systems<br>DM0022]:::defender --> DM0020
    DM0020[Share Intel<br>DM0020]:::defender

    %% Defense Actions
    DS0017 -.-> Initial
    DS0022 -.-> Exec
    DS0015 -.-> Persist
    DS0016 -.-> Lateral
    DM0006 -.-> C2
    DM0009 -.-> Exfil

    classDef attacker fill:#FF4040,stroke:#8B0000,color:white
    classDef defender fill:#4169E1,stroke:#00008B,color:white

Enhanced Monitoring Implementation

Organizations should implement comprehensive monitoring covering:

Endpoint Detection
- Process creation monitoring with focus on suspicious Python processes
- File modification tracking in critical system directories
- Network connection monitoring for unusual patterns
Authentication Monitoring
- Track failed login attempts across all systems
- Monitor for unusual access patterns or off-hours activity
- Alert on privilege escalation events
Network Traffic Analysis
- Monitor for unusual outbound connections
- Track large data transfers
- Identify command and control traffic patterns

Access Control Framework

Organizations should implement strict access controls:

Privileged Accounts
- Require phishing-resistant MFA
- Implement 30-day credential rotation
- Set 1-hour session timeouts
- Regular access reviews
Standard User Accounts
- Enforce MFA for all access
- 90-day password rotation
- 8-hour session limits
- Least privilege access model

Detection Engineering

Key detection strategies should include:

Authentication Monitoring
- Track all login attempts from non-whitelisted IPs
- Monitor for authentication attempts outside normal hours
- Alert on multiple failed attempts
System Integrity Checks
- Regular file integrity monitoring
- Verification of critical system binaries
- Monitoring of configuration changes

Future Preparedness

Zero-Trust Implementation
- Verify every request
- Implement least-privilege access
- Monitor all network traffic
Advanced Detection
- Deploy next-gen EDR solutions
- Implement behavioral analytics
- Enable comprehensive logging
Response Readiness
- Regular tabletop exercises
- Updated playbooks
- Clear communication channels

Conclusion

The Ivanti CSA vulnerabilities serve as a critical reminder that cybersecurity requires both strategic leadership and technical excellence. Organizations must balance immediate tactical responses with long-term strategic improvements to build true cyber resilience.

Stay secure, stay prepared.

For detailed IOCs and technical discussions, connect with your security team or join a threat intelligence sharing program.