Ivanti Connect Secure (formerly Pulse Secure) is a SSL-VPN appliance that sits at the network perimeter, providing remote access for the entire organization. CVE-2023-46805 is an authentication bypass via path traversal in the web interface. CVE-2024-21887 is an arbitrary command injection in the web components. Chained together: unauthenticated, SYSTEM-level RCE on the device that controls remote access to your entire network.

Attackers deployed persistent web shells (SLIVER variants, "GiftCard"), stole active session cookies (bypassing MFA like Citrix Bleed), harvested cached credentials, and used the VPN appliance itself as a pivot point to sweep internal networks. CISA issued Emergency Directive 24-01 ordering federal agencies to disconnect Ivanti appliances. Ivanti's Internal Integrity Checker Tool (ICT) initially failed to detect compromises, requiring an external integrity verification approach.

1. 1. Search for path traversal exploitation in HTTP logs Analyze traffic to the VPN appliance for directory traversal sequences targeting API endpoints: /api/v1/totp/user-backup/exports and /api/v1/license/keys-status/. Look for ..%2f or ../ sequences used to bypass authentication. Suricata ET signatures cover these patterns. Zeek http.log: URI containing ..%2f targeting Ivanti API paths · Suricata ET EXPLOIT Ivanti
2. 2. Check for outbound connections FROM the VPN appliance A hardened VPN appliance should rarely initiate outbound connections to arbitrary external IPs. Any outbound connection on non-standard ports from the VPN gateway's IP indicates reverse shell or C2 traffic. This is the clearest network-level indicator of post-exploitation. Zeek conn.log: src_ip == VPN_gateway AND dst_ip NOT IN [expected update servers]
3. 3. Hunt for web shells on the appliance If you have appliance access: search for new or unrecognized Python/Perl files in /tmp/ or web root directories. Run an external integrity check (not Ivanti's built-in ICT, which was bypassed). Compare file hashes against known-good Ivanti release images. Appliance integrity: file hash comparison against vendor baseline · External ICT
4. 4. Hunt for lateral movement from the VPN gateway IP Search for anomalous internal traffic originating from the VPN appliance's internal IP address: LDAP queries to domain controllers, SMB sweeps, SSH attempts to internal servers, and RDP connections. The VPN gateway should not be initiating lateral connections. Zeek conn.log: src_ip == VPN_internal_IP to internal DCs/servers · Security EID 4624 from VPN IP
5. 5. Check for session cookie theft (MFA bypass) Like Citrix Bleed, attackers steal active session cookies from the compromised appliance. Hunt for: concurrent session use from multiple IPs, sessions without corresponding MFA events, and impossible travel on VPN session tokens. VPN session logs · MFA correlation · Impossible travel detection

Edge Device Compromised (Ivanti is already on the CVE list)
Citrix Bleed (same session-theft MFA bypass pattern)
Volt Typhoon (SYLVANITE rapidly weaponizes Ivanti CVEs)