Sid:2055984 Ivanti Cloud Service Appliance Authenticated Command Injection (CVE-2024-8190)

Greetings friends!

sid:2055984 references www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/, however it is not alerting on POST requests produced by the POC (GitHub - horizon3ai/CVE-2024-8190: CVE-2024-8190: Ivanti Cloud Service Appliance Command Injection).

Example POST data payload:

POST /gsb/datetime.php HTTP/1.1
Host: 127.0.0.1:80
User-Agent: python-requests/2.28.1
Accept-Encoding: gzip, deflate
Accept: /
Connection: keep-alive
Content-Length: 133
Content-Type: application/x-www-form-urlencoded
Authorization: Basic YWRtaW46YWRtaW4=

dateTimeFormSubmitted=1&TIMEZONE=%3B+%60yes+%27Happy+Friday%27%60+%3B&CYEAR=2024&CMONTH=9&CDAY=13&CHOUR=12&CMIN=34&LDCSA_CSRF=sp00fLDCSA&SUBMIT_TIME=Save

The signature appears to be looking for JSON content, ex: content:“|22|TIMEZONE|22 3a|”, but this POC sends the data as application/x-www-form-urlencoded, which is the default Content-Type used by python Requests.

1 Like

@rampage Thanks for the heads up! Expect an update in the today’s release.

2 Likes