Authenticated Arbitrary File Write in Ivanti Neurons for ITSM

Successful exploitation allows an authenticated attacker to place attacker-controlled files on the Ivanti Neurons for ITSM server. This arbitrary file write capability can be leveraged to achieve command execution on the host, with execution occurring in the security context of a non-root user. The resulting impact includes compromise of the application host, unauthorized modification of server-side content, and potential follow-on activity such as persistence or lateral movement depending on the surrounding environment and privileges available to the compromised account.

Identify all on-premises Ivanti Neurons for ITSM instances and apply vendor patches immediately. Where immediate upgrading is not possible, reduce exposure by restricting access to authenticated interfaces to only trusted administrative users and networks, reviewing and minimizing accounts with access to file upload or content management functionality, and monitoring for suspicious server-side file creation and post-authentication abuse. Cloud-hosted instances were reported as already patched.

Upgrade affected on-premises Ivanti Neurons for ITSM deployments to a fixed release, specifically version 2023.4 or later, or the vendor-designated patched 2023.x release for the deployed branch. Prioritize patching all supported affected versions, including 2023.1, 2023.2, 2023.3, and older releases identified as vulnerable.