Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access

Severity

High

Detail

Researchers from Volexity have identified active exploitation of multiple zero-day vulnerabilities affecting Ivanti Connect Secure VPN appliances. The activity has been attributed to UTA0576, which successfully chained the vulnerabilities to obtain unauthenticated root access on internet-facing VPN gateways. The campaign was observed targeting a limited number of organizations, including systems that had already received previous security updates.

The attackers leveraged the vulnerabilities to gain full control of affected appliances, extract stored credentials, access sensitive Active Directory information, retrieve Windows LAPS administrator passwords, and obtain BitLocker recovery keys. Researchers noted that the attack relies heavily on memory-only modifications and restoration of altered settings, making detection more difficult and allowing malicious activity to evade some integrity-checking mechanisms.

According to the investigation, compromised VPN appliances served as a gateway for further reconnaissance and credential harvesting activities within victim environments. The observed operations included credential collection, username enumeration, password spraying, and network traffic analysis to identify additional credentials.

How?

The attack chain begins with an authentication bypass vulnerability in the public-facing welcome[.]cgi login component. A mismatch between the requested URL and the X-DSCGI-PATH header allows an attacker to access protected functionality without successful authentication.

The attacker subsequently abuses the wu[.]cgi upload handler, which temporarily stores uploaded content before validating it as a ZIP archive. By uploading a malicious Perl script and exploiting a timing weakness, the attacker executes arbitrary code before the temporary file is removed.

Code execution is initially achieved under the privileges of the appliance’s cgi-server account. The attacker then abuses the privileged dsinvoked service by modifying library code in memory and altering maintenance task configuration data stored within the DSCache configuration database. This manipulation causes the service to execute attacker-controlled code with root privileges, providing complete control of the appliance. Following execution, the attacker restores modified settings and memory contents in an effort to conceal the compromise.

After obtaining root access, the threat actor extracts stored directory service credentials and leverages the VPN appliance’s Active Directory service account to query internal enterprise environments. The attackers also conducted password spraying, user enumeration, and packet analysis activities to support further lateral movement opportunities inside targeted networks.

Conclusion

The exploitation of multiple zero-day vulnerabilities in Ivanti Connect Secure demonstrates the continued targeting of internet-facing VPN infrastructure by advanced threat actors. By chaining authentication bypass, code execution, and privilege escalation vulnerabilities, attackers were able to gain unauthenticated root access and harvest valuable credentials from affected environments.

The ability to compromise fully patched systems, access sensitive Active Directory data, and evade detection through memory-only modifications significantly increases the risk posed by this activity. Organizations should prioritize patching, conduct thorough compromise assessments, and closely monitor VPN infrastructure for indications of unauthorized access and credential theft.

Source

https://cybersecuritynews.com/ivanti-connect-secure-zero-days-exploited/