OS Command Injection in Ivanti Cloud Services Appliance Administrative Console

Successful exploitation permits arbitrary operating-system command execution on the affected CSA appliance in the context of the vulnerable service. An attacker can use this access to deploy web shells or other persistence mechanisms, steal administrative credentials and secrets, alter appliance configuration, collect data, and pivot into internal networks. Observed campaigns used chained CSA flaws for initial access, credential theft, persistence, and lateral movement.

Restrict administrative-console access to trusted management networks and authorized administrators; do not expose the console directly to the public internet. Apply network segmentation and least-privilege controls, monitor CSA systems for anomalous administrative-console activity and web-shell persistence, and audit internet-facing applications for exposed credentials. Where immediate upgrading is not possible, isolate the appliance from untrusted networks and closely monitor or disable nonessential access until remediation is complete.

Upgrade Ivanti Cloud Services Appliance to version 5.0.2 or later, which addresses CVE-2024-9380 and the related CSA vulnerabilities. CSA 4.6 is unsupported and should be upgraded rather than retained. For appliances exposed during the September through November 2024 exploitation period, treat patching alone as insufficient: isolate affected devices, preserve forensic evidence, rebuild compromised appliances from trusted media, reset all appliance, administrative-directory, and transiting credentials and secrets, and investigate for persistence and lateral movement.