erroneo.us
Search all guides⌘K

Security Digest · Sep 10, 2024 · Vulnerability · Network edge

Ivanti CSA CVE-2024-8190: Zero-Day Chain on EOL Appliance

Command injection in end-of-life Ivanti CSA 4.6 (Patch 518 and earlier) was chained as a zero-day by a suspected state actor. Retire 4.6; rebuild if exposed.

Published By erroneo.us Security Desk · Updated 3 min read14 sources

Our verdict

Check exposure

Any CSA 4.6 still running should be retired, and any that faced the internet in fall 2024 should be treated as compromised and rebuilt, because the bug was chained as a zero-day to steal credentials and move inside networks.

Who must act: Anyone still running Ivanti CSA 4.6, and anyone whose CSA 4.6 was internet-facing in September 2024 or later, even if it was patched afterward.

Who can relax: Organizations that never ran Ivanti CSA, and CSA 5.0 users on 5.0.3 or later whose 4.6 appliances were retired before September 2024.

Affected
Ivanti CSA 4.6 Patch 518 and earlier (end-of-life)
Chained with CVE-2024-8963, which affects CSA 4.6 before Patch 519
Fixed in
CSA 4.6 Patch 519 (Sep 10, 2024), the last fix for the end-of-life 4.6 line
CSA 5.0 is outside the affected range
Today: CSA 5.0.3 or later, because of CVE-2024-9379/9380 (fixed in 5.0.2) and CVE-2024-11639 (fixed in 5.0.3)
CVSS
7.2 (v3.1, CNA)
EPSS
88.5% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Find every Ivanti CSA and record its version and patch level from the admin console.
  2. Decommission CSA 4.6; it is end-of-life and gets no OS or library fixes. Move to CSA 5.0.3 or later.
  3. If a 4.6 appliance was internet-facing in September 2024 or later, rebuild it from scratch rather than cleaning it.
  4. Rotate every credential the appliance stored or used, including admin, gsbadmin and any domain accounts.
  5. Keep the console on the internal interface only, with the dual-homed eth0-internal layout Ivanti recommends.
  6. Check the servers the CSA could reach, such as Endpoint Manager and its SQL server, for follow-on activity.

How to check if you are affected or compromised

  • Look for CSA admin users you did not create; FortiGuard found accounts named aiadmin and services.
  • Search /var/log/messages and rotated copies for datetime.php requests and the line '/etc/php.ini rewritten with new timezone'.
  • Check /opt/landesk/broker/webroot/gsb/ and /opt/landesk/broker/webroot/client/index.php for webshells or modified PHP files.
  • Look for /tmp/brokerdebug, /tmp/php.ini, or a binary named php plus six characters in /tmp.
  • Review sudo log entries for the nobody, admin and gsbadmin accounts, especially edits to DateTimeTab.php.

What happened#

On September 10, 2024, Ivanti disclosed CVE-2024-8190, an OS command injection in the admin console of its Cloud Services Appliance (CSA). The CVE record says it affects CSA 4.6 Patch 518 and earlier. It gives a remote attacker code execution, but only with admin privileges. Ivanti scores it CVSS 3.1 7.2. The fix, Patch 519, was the last one for the 4.6 line, which had already reached end-of-life. On September 13, Ivanti said a "limited number of customers" had been exploited, as quoted by BleepingComputer. That day CISA urged an upgrade to CSA 5.0 and added the CVE to KEV.

Horizon3.ai found the root cause on September 16. The TIMEZONE value from the date-and-time page went to exec without validation. The admin login had no rate limiting, so weak or never-changed passwords were a plausible way in. The admin requirement soon stopped mattering. On September 19, Ivanti disclosed CVE-2024-8963, an unauthenticated path traversal. Per BleepingComputer, Ivanti said Patch 519 had fixed it "incidentally." Chained with CVE-2024-8190, it lets an attacker skip admin login and run commands. It joined KEV the same day.

The attacks started before disclosure. FortiGuard saw the first path traversal request on September 4. The attacker also used a third bug, CVE-2024-9380. It harvested admin and gsbadmin passwords, planted webshells and tried to install a kernel rootkit. It then moved to an internal SQL server and finally patched the command injection bugs itself to keep others out. France's ANSSI calls the actor Houken and links it to UNC5174. It says the three CVEs "were exploited as zero-days" against French government, telecom, media, finance and transport bodies, with operator activity in UTC+8. In January 2025, CISA and the FBI described the chains in AA25-022A.

Who is affected#

CSA 4.6 Patch 518 and earlier. CSA 5.0 is outside the affected range for this CVE, but CVE-2024-9379 and CVE-2024-9380 affect 5.0 before 5.0.2. A separate authentication bypass, CVE-2024-11639, affects 5.0 before 5.0.3.

Do you really need to act?#

Only if you run or ran Ivanti CSA, and then the verdict is check exposure with a short fuse. CSA 4.6 gets no more fixes, so the only safe 4.6 box is a switched-off one. If a 4.6 appliance faced the internet in September 2024, assume it was probed. AA25-022A says credentials stored on it "should be considered compromised," and that removing malicious admin accounts may not be enough. Ivanti's own advice for suspected compromise was to rebuild.

What to do now#

  1. Find every CSA and record its version and patch level.
  2. Decommission CSA 4.6. Run 5.0.3 or later.
  3. Rebuild, do not clean, any 4.6 appliance that was internet-facing in or after September 2024. Rotate every credential it held.
  4. Keep the console on the internal interface only, with eth0 as the internal network in a dual-homed setup.

How to tell if you were hit#

  • Look for admin users you did not create. FortiGuard found aiadmin and services.
  • Run zgrep -h 'datetime.php\|rewritten with new timezone' /var/log/messages* and review the hits.
  • Check /opt/landesk/broker/webroot/gsb/ and /opt/landesk/broker/webroot/client/index.php for webshells or modified files, and look for /tmp/brokerdebug and /tmp/php.ini.

Timeline#

  • — First exploitation request seen by FortiGuard.
  • — Ivanti discloses CVE-2024-8190 and releases CSA 4.6 Patch 519.
  • — Ivanti confirms exploitation; CISA adds the CVE to KEV.
  • — CVE-2024-8963 disclosed and added to KEV.
  • — FortiGuard publishes its incident analysis.
  • — CISA and FBI publish AA25-022A.
  • — ANSSI publishes its Houken report.

Vulnerability records

  • CVE-2024-8190 · KEV 2024-09-13 · An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CISA — Ivanti Releases Security Update for Cloud Services Appliance (Sep 13, 2024) cisa.gov
  2. CVE record — CVE-2024-8190 cve.org
  3. NVD — CVE-2024-8190 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2024-8190 cisa.gov
  5. CVE record — CVE-2024-8963 cve.org
  6. CISA — Known Exploited Vulnerabilities: CVE-2024-8963 cisa.gov
  7. CISA and FBI — AA25-022A: Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications cisa.gov
  8. Horizon3.ai — CISA KEV CVE-2024-8190: Ivanti CSA Command Injection horizon3.ai
  9. Fortinet FortiGuard Labs — Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA fortinet.com
  10. ANSSI (CERT-FR) — CERTFR-2025-CTI-009: Houken, seeking a path by living on the edge with zero-days cert.cyber.gouv.fr
  11. CVE record — CVE-2024-9380 cve.org
  12. CVE record — CVE-2024-11639 cve.org

Coverage and analysis

  1. BleepingComputer — Ivanti warns high severity CSA flaw is now exploited in attacks (Sep 13, 2024) bleepingcomputer.com
  2. BleepingComputer — Ivanti warns of another critical CSA flaw exploited in attacks (Sep 19, 2024) bleepingcomputer.com