[AL-143] Critical Vulnerabilities in Ivanti Cloud Services Appliance

Ivanti has released security updates to address critical vulnerabilities (CVE-2024-11639, CVE-2024-11772 and CVE-2024-11773) affecting their Cloud Services Appliance (CSA) solution. CVE-2024-11639 has a Common Vulnerability Scoring System (CVSSv3) score of 10 out of 10.

The vulnerabilities are:

• CVE-2024-11639: An authentication bypass vulnerability in the admin web console which could allow a remote unauthenticated attacker to gain administrative access.
• CVE-2024-11772: A command injection vulnerability in the admin web console which could allow a remote authenticated attacker with admin privileges to achieve remote code execution.
• CVE-2024-11773: A SQL injection vulnerability in the admin web console which could allow a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

The vulnerability affects Ivanti CSA versions 5.0.2 and earlier.

Users and administrators of affected product versions are advised to update to the latest version immediately.

More information is available here: 

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773?language=en_US

https://www.bleepingcomputer.com/news/security/ivanti-warns-of-maximum-severity-csa-auth-bypass-vulnerability/

https://nvd.nist.gov/vuln/detail/CVE-2024-11639

https://nvd.nist.gov/vuln/detail/CVE-2024-11772

https://nvd.nist.gov/vuln/detail/CVE-2024-11773