Remote Code Execution Vulnerability in Ivanti Cloud Services Appliance
CVE-2024-8190

7.2HIGH

Key Information:

Vendor: Ivanti
Status: Csa (cloud Services Appliance)
Vendor: CVE Published:; 10 September 2024

Badges

📈 Trended📈 Score: 4,330👾 Exploit Exists🟡 Public PoC🟣 EPSS 11%🦅 CISA Reported📰 News Worthy

What is CVE-2024-8190?

CVE-2024-8190 is a critical remote code execution vulnerability found in the Ivanti Cloud Services Appliance, specifically in versions 4.6 Patch 518 and earlier. The Ivanti Cloud Services Appliance is used for managing IT services within organizations, providing tools for cloud management and automation. This vulnerability allows remote authenticated attackers with administrative privileges to execute arbitrary commands on the affected system, posing a significant risk to data integrity and system security.

Technical Details

The vulnerability stems from an OS command injection flaw that permits attackers to manipulate commands that the system executes. To exploit CVE-2024-8190, an attacker needs to authenticate as an admin, which highlights the importance of robust access controls. If successfully exploited, this vulnerability could enable unauthorized access to sensitive system functions, leading to further consequences.

Impact of the Vulnerability

Remote Code Execution: Successful exploitation allows attackers to execute arbitrary code on the system, leading to potentially devastating ramifications—including unauthorized access to sensitive data and system control.
Escalation of Privileges: Given that exploitation requires admin access, attackers could gain elevated privileges, allowing them to manipulate system operations and configurations, thereby compromising organizational integrity.
Data Breaches: With the ability to run code remotely, attackers could extract, modify, or erase sensitive data, which could lead to significant financial and reputational damage to the organization involved.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

Affected Version(s)

CSA (Cloud Services Appliance) 4.6 Patch 519

CSA (Cloud Services Appliance) 5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-8190
Created by horizon3ai