Ivanti Connect Secure Exploitation 2024: How Two VPN Zero-Days Exposed Credentials, Service Accounts and Sessions

In January 2024, Ivanti disclosed two zero-day vulnerabilities in its Connect Secure and Policy Secure gateways, CVE-2023-46805 and CVE-2024-21887. Chained together, they let an unauthenticated attacker run commands on the VPN appliance itself. Attackers used that position to harvest the usernames and passwords of people logging in, dump appliance configurations holding sensitive credentials, and move into internal networks. Victims included the US Cybersecurity and Infrastructure Security Agency (CISA), which took two systems offline, and MITRE, where attackers used session hijacking to get around multi-factor authentication. The identity lesson is blunt: an edge appliance that brokers authentication holds user credentials, service account passwords, API keys and certificates, and when it falls, all of them must be treated as stolen.

At a glance

What happened

Volexity detected suspicious activity at a customer in the second week of December 2023 and traced it to an Ivanti Connect Secure VPN appliance. It published its findings on 10 January 2024, the same day Ivanti disclosed the two flaws. Tenable describes CVE-2023-46805 as an authentication bypass (CVSS 8.2) and CVE-2024-21887 as a command injection flaw (CVSS 9.1). Used as a chain, they give an unauthenticated attacker remote code execution on the gateway. Mandiant dates the earliest zero-day exploitation to 3 December 2023 and assessed "with moderate confidence that UNC5221 is a China-nexus espionage threat actor".

The attackers went straight for credentials. Mandiant found a credential harvester it named WARPWIRE, JavaScript inserted into a legitimate appliance file. In Mandiant's words, "WARPWIRE captures credentials submitted during the web logon to access layer 7 applications, like RDP". Every user who logged in while it was active handed over a plaintext username and password. Mandiant also saw the attackers patch the appliance's dsls binary to bypass "a check in the legitimate dsls binary responsible for redacting sensitive data", then dump the configuration. Volexity documented the next stage: using stolen credentials to log in to workstations and servers, dumping LSASS memory, extracting the Active Directory database from a domain controller backup, and moving laterally over RDP, SMB and SSH.

Once the flaws were public, exploitation spread fast. Volexity said mass exploitation started on 11 January and that by 14 January it had "been able to find evidence of compromise of over 1,700 devices worldwide", across government, telecoms, defence, finance and other sectors. It also noted that "additional attackers beyond UTA0178 appear to have access to the exploit". Ivanti later disclosed further flaws in the same products, including CVE-2024-21888 and CVE-2024-21893, and released patches from 31 January.

CISA issued Emergency Directive 24-01 on 19 January 2024. Supplemental direction on 31 January ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure products by 2 February and, before reconnecting, to reset the admin enable password, "Reset stored application programming interface (API) keys", "Reset the password of any local user defined on the gateway, including service accounts used for auth server configuration(s)" and "Revoke and reissue any connected or exposed certificates, keys, and passwords". On 29 February 2024, CISA and partners published advisory AA24-060B. As reported by BleepingComputer, it warned that Ivanti's Integrity Checker Tool had failed to detect compromise, that "a cyber threat actor may be able to gain root-level persistence despite issuing factory resets", and that organisations should "assume that user and service account credentials stored within the affected Ivanti VPN appliances are likely compromised". Ivanti said it and its partners were "not aware of any instances of successful threat actor persistence following implementation of the security updates and factory resets."

CISA was a victim too. On 8 March 2024, The Record reported the breach, and CISA confirmed that "About a month ago CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses. The impact was limited to two systems, which we immediately took offline." Reporting identified the two as the Infrastructure Protection Gateway and the Chemical Security Assessment Tool (CSAT). CISA later said a malicious actor "installed an advanced webshell on the Ivanti device" serving CSAT between 23 and 26 January 2024. Its investigation "did not identify adversarial access beyond the Ivanti device nor data exfiltration from the CSAT environment", but because the exposed environment held CSAT user accounts and sensitive submissions, CISA encouraged account holders to reset reused passwords.

MITRE disclosed in April 2024 that attackers had breached its Networked Experimentation, Research, and Virtualization Environment (NERVE) in January. According to BleepingComputer's account of MITRE's statements, the attackers chained the same two Ivanti zero-days, used session hijacking to get around multi-factor authentication, and moved laterally through VMware infrastructure using a stolen admin account. MITRE said the breach did not reach its core enterprise network or partner systems.

Timeline

How it happened: the identity attack path

1. An identity broker at the edge. The Connect Secure gateway sits on the internet and authenticates users on behalf of the organisation. To do that it holds its own secrets: local accounts, service accounts that bind to the authentication server, API keys and certificates.
2. Authentication bypassed, commands executed. CVE-2023-46805 let the attacker reach restricted functions without logging in. CVE-2024-21887 let them run commands. The appliance was now theirs.
3. Credentials captured at the front door. WARPWIRE, inserted into the login page, sent each user's plaintext username and password to attacker infrastructure. Human credentials were harvested at scale, one login at a time.
4. Machine secrets pulled from configuration. A patched dsls binary dumped the appliance configuration without redaction. CISA's direction to reset service accounts, API keys and certificates reflects what that configuration can contain.
5. Directory credentials and lateral movement. With valid accounts, the attackers logged in to internal systems, dumped LSASS memory and extracted the Active Directory database from a backup, according to Volexity.
6. Sessions reused past MFA. At MITRE, session hijacking let the attackers act as authenticated users without facing MFA, and a stolen admin account opened up the VMware environment.
7. Hiding in the appliance. CISA found the integrity checker could miss compromise and that root-level persistence might survive a factory reset, so rotating secrets after cleanup was essential, not optional.

Impact

• Scale: more than 1,700 compromised devices worldwide by 14 January 2024, per Volexity.
• Government: CISA took two systems offline, including CSAT, whose environment held sensitive chemical facility submissions and user accounts. CISA found no evidence of exfiltration.
• Research: MITRE's NERVE collaborative network was breached; MITRE said its core enterprise network was not affected.
• Operational: US federal agencies had to disconnect every affected gateway, rebuild them, and reset credentials, keys and certificates. Where domain accounts were exposed, agencies were told to reset passwords twice, revoke Kerberos tickets and revoke cloud tokens.
• Trust in tooling: CISA's finding that the integrity checker missed compromise undermined the main detection route many customers relied on.

What this means for NHI governance

Most coverage of Ivanti focused on patching speed. The identity angle is less discussed and lasts longer. A VPN gateway is not only a network device; it is an identity system. It holds a bind account to the directory, local administrative accounts, API keys for integrations, and certificates for TLS and device trust. When the appliance is compromised, the attacker holds all of these non-human identities, plus a stream of human passwords typed in by staff.

CISA's instructions are effectively an NHI checklist: reset stored API keys, reset service accounts used for authentication server configuration, revoke and reissue certificates and keys. Few organisations could do that quickly in January 2024, because they did not know which secrets lived on the gateway, who owned them, or what would break if they were rotated. That is the everyday reality of unmanaged machine identities, exposed under pressure.

The MITRE case shows the other half. MFA protects the login event. It does not protect a session that already exists. Once attackers could hijack sessions, the strong authentication at the front door was irrelevant. The same is true for machine credentials: a bearer token or cookie is as good as the authentication that produced it, for as long as it lives. The pattern repeats on our timeline, from SonicWall VPN accounts to Salt Typhoon's use of network device flaws and stolen credentials.

Recommendations

• Inventory secrets held by edge appliances. For every VPN, firewall and gateway, record the service accounts, API keys and certificates it stores, their owners and their blast radius. Our NHI Lifecycle Management Guide covers discovery and ownership.
• Pre-plan emergency rotation. Be able to rotate every appliance-held credential within hours. Test it before you need it. See our guide to NHI rotation challenges.
• Scope directory bind accounts tightly. The account a gateway uses to query your directory should be read-only, limited to what authentication needs, and monitored for any other use.
• Reset human credentials after appliance compromise. Follow Mandiant's advice to reset passwords of any users who authenticated while a harvester was active, not just local appliance accounts.
• Shorten and bind sessions. Short session lifetimes, re-authentication for sensitive actions and device-bound sessions limit what a hijacked session is worth. Our Workforce Identity Security Guide covers session theft.
• Do not trust a single integrity check. Use external integrity checks, off-box logging and network monitoring for appliance behaviour, and treat privileged accounts touched by the appliance under the controls in our Privileged Access Management Guide.

Frequently asked questions

What are CVE-2023-46805 and CVE-2024-21887?

CVE-2023-46805 is an authentication bypass and CVE-2024-21887 is a command injection flaw in Ivanti Connect Secure and Ivanti Policy Secure gateways. Chained together, they allow an unauthenticated attacker to run commands on the appliance.

Was CISA hacked through Ivanti?

Yes. CISA confirmed in March 2024 that it had found exploitation of Ivanti products it used and took two systems offline. One was the Chemical Security Assessment Tool, where an advanced web shell was installed between 23 and 26 January 2024. CISA said it found no evidence of data exfiltration.

Why is this a non-human identity issue and not just a patching issue?

The gateway stored service account passwords, API keys and certificates. CISA told organisations to assume those credentials were compromised and to rotate them. Patching closed the hole; only rotating the machine and user credentials removed the attacker's stolen access.

Related NHI Mgmt Group resources

SonicWall VPN accounts breach · Salt Typhoon telecoms breach · Cisco Active Directory credentials leak · Guide to NHI Rotation Challenges · Top 10 NHI Issues · All NHI breaches

How NHI Mgmt Group can help

Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target service accounts, API keys, certificates, tokens and the appliances that store them. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and rotate these identities before an incident forces them to.

References

• Volexity: Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN (10 January 2024)
• Volexity: Ivanti Connect Secure VPN Exploitation Goes Global (15 January 2024)
• Mandiant: Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation (11 January 2024)
• Mandiant: Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation (31 January 2024)
• Tenable: CVE-2023-46805, CVE-2024-21887: Zero-Day Vulnerabilities Exploited in Ivanti Connect Secure and Policy Secure Gateways (10 January 2024)
• Ivanti: Security Update for Ivanti Connect Secure and Ivanti Policy Secure Gateways (31 January 2024)
• CISA: ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities (19 January 2024, with supplemental direction 31 January and 9 February 2024)
• CISA: CISA Issues Emergency Directive on Ivanti Vulnerabilities (19 January 2024)
• BleepingComputer: CISA cautions against using hacked Ivanti VPN gateways even after factory resets (29 February 2024)
• TechTarget: CISA confirms compromise of its Ivanti systems (11 March 2024)
• Cybersecurity Dive: CISA attacked in Ivanti vulnerabilities exploit rush (11 March 2024)
• TechTarget: CISA discloses breach of Chemical Security Assessment Tool (25 June 2024)
• BleepingComputer: MITRE says state hackers breached its network via Ivanti zero-days (19 April 2024)