# MA-1025.022024: MyCERT Advisory - New Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways

**Date:** 04 Feb 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1025.022024  
**Advisory ID:** MA-1025.022024

---

**1.0 Introduction**
On Jan 31, 2024, disclosed two additional vulnerabilities impacting Ivanti Connect Secure VPN (CS, formerly Pulse Secure) and Ivanti Policy Secure (PS) devices, CVE-2024-21888 and CVE-2024-21893, besides the two high-impact zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887 affecting CS and PS appliances. Mandiant has identified zero-day exploitation of these vulnerabilities in the wild beginning as early as Dec. 3, 2023, by a suspected China-nexus espionage threat actor currently being tracked as UNC5221.
**2.0 Impact**
The vulnerabilities allow for an unauthenticated threat actor to execute arbitrary commands on the appliance with elevated privileges.
**3.0 Affected Products**
|  | --- | --- | **Product** | **Versions** | ICS | - affected from 9.1R18 through 9.1R18 |  | - affected from 22.6R2 through 22.6R2 | IPS | - affected from 9.1R18 through 9.1R18 |  | - affected from 22.6R1 through 22.6R1 |
**4.0 Indicators of Compromise (IOCs)**
4.1 Host-Based Indicators (HBIs)
|  |
| --- | --- | --- | **Filename** | **MD5** | **Description** | health.py | 3045f5b3d355a9ab26ab6f44cc831a83 | CHAINLINE web shell | compcheckresult.cgi | 3d97f55a03ceb4f71671aa2ecf5b24e9 | LIGHTWIRE web shell | lastauthserverused.js | 2ec505088b942c234f39a37188e80d7a | WARPWIRE credential harvester variant | lastauthserverused.js | 8eb042da6ba683ef1bae460af103cc44 | WARPWIRE credential harvester variant | lastauthserverused.js | a739bd4c2b9f3679f43579711448786f | WARPWIRE credential harvester variant | lastauthserverused.js | a81813f70151a022ea1065b7f4d6b5ab | WARPWIRE credential harvester variant | lastauthserverused.js | d0c7a334a4d9dcd3c6335ae13bee59ea | WARPWIRE credential harvester | lastauthserverused.js | e8489983d73ed30a4240a14b1f161254 | WARPWIRE credential harvester variant | category.py | 465600cece80861497e8c1c86a07a23e | FRAMESTING web shell | logo.gif | N/A — varies | Configuration and cache dump or CAV web server log exfiltration | login.gif | N/A — varies | Configuration and cache dump | [a-fA-F0-9]{10}\.css | N/A — varies | Configuration and cache dump | visits.py | N/A — varies | WIREFIRE web shell |
4.2 Network-Based Indicators (NBIs)
|  |
| --- | --- | --- | **Network Indicator** | **Type** | **Description** | symantke[.]com | Domain | WARPWIRE C2 server | miltonhouse[.]nl | Domain | WARPWIRE variant C2 server | entraide-internationale[.]fr | Domain | WARPWIRE variant C2 server | api.d-n-s[.]name | Domain | WARPWIRE variant C2 server | cpanel.netbar[.]org | Domain | WARPWIRE variant C2 server | clickcom[.]click | Domain | WARPWIRE variant C2 server | clicko[.]click | Domain | WARPWIRE variant C2 server | duorhytm[.]fun | Domai??n | WARPWIRE variant C2 server | line-api[.]com | Domain | WARPWIRE variant C2 server | areekaweb[.]com | Domain | WARPWIRE variant C2 server | ehangmun[.]com | Domain | WARPWIRE variant C2 server | secure-cama[.]com | Domain | WARPWIRE variant C2 server | 146.0.228[.]66 | IPv4 | WARPWIRE variant C2 server | 159.65.130[.]146 | IPv4 | WARPWIRE variant C2 server | 8.137.112[.]245 | IPv4 | WARPWIRE variant C2 server | 91.92.254[.]14 | IPv4 | WARPWIRE variant C2 server | 186.179.39[.]235 | IPv4 | Mass exploitation activity | 50.215.39[.]49 | IPv4 | Post-exploitation activity | 45.61.136[.]14 | IPv4 | Post-exploitation activity | 173.220.106[.]166 | IPv4 | Post-exploitation activity |
**5.0 Identities of New Malware**
5.1 BUSHWALK
BUSHWALK is written in Perls and embedded into a legitimate CS file, **querymanifest.cgi**. BUSHWALK provides a threat actor the ability to read or write to files to a server.
BUSHWALK executes its malicious Perl function, **validateVersion**, if the web request **platform** parameter is **SafariiOS**. It uses Base64 and RC4 to decode and decrypt the threat actor’s payload in the web request’s **command** parameter.
Figure 1: Entry point to BUSHWALK execution.
The decrypted payload determines if the web shell should read a file from the server or write a file to the server.
If the decrypted payload contains **change**, BUSHWALK calls the **changeData** function to read an arbitrary file from the compromised appliance. The malware extracts a file path from the buffer. The malware then opens and reads the file at the specified path and encrypts the file content with RC4 using the provided key.
Figure 2: changeVersion function to read an arbitrary file
If the decrypted payload contains **update**, BUSHWALK calls the **updateVersion** function to write an arbitrary file to the server. It extracts a file path and the data to write to the file from the buffer. This new file data is then Base64-decoded and written to the file at the specified path.
Figure 3: updateVersion function to write an arbitrary file.
5.2 CHAINLINE
CHAINLINE is a Python web shell backdoor that is embedded in a Ivanti Connect Secure Python package that enables arbitrary command execution.
CHAINLINE was identified in the CAV Python package in the following path: **/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/health.py**. This is the same Python package modified to support the WIREFIRE web shell.
Figure 4: CHAINLINE web shell in health.py
Unlike WIREFIRE, which modifies an existing file, CHAINLINE creates a new file called **health.py**, which is not a legitimate filename in the CAV Python package. The existence of this filename or an associated compiled Python cache file may indicate the presence of CHAINLINE.
UNC5221 registered a new API resource path to support the access of CHAINLINE at the REST endpoint **/api/v1/cav/client/health**. This was accomplished by importing the maliciously created Health API resource and then calling the **add\_resource()** class method on the FLASK-RESTful **Api**object **within /home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/\_\_init\_\_.py.**
Figure 5: Python CAV package modified to support CHAINLINE.
5.3 FRAMESTING
FRAMESTING is a Python web shell embedded in a Ivanti Connect Secure Python package that enables arbitrary command execution.
Figure 6: category.py modified to handle POST requests for FRAMESTING.
FRAMESTING was identified in the CAV Python package in the following path: **/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py.** Note that this is the same Python package modified to support the WIREFIRE and CHAINLINE web shells.
When installed, the threat actor can access FRAMESTING web shell at the REST endpoint **/api/v1/cav/client/categories** with a POST request. Note that the legitimate **categories** endpoint only accepts GET requests.
The web shell employs two methods of accepting commands from an attacker. It first attempts to retrieve the command stored in the value of a cookie named **DSID** from the current HTTP request. If the cookie is not present or is not of the expected length, it will attempt to decompress **zlib** data within the request's POST data. Lastly, FRAMESTING will then pass the decrypted POST data into a Python **exec()** statement to dynamically execute additional Python code.
5.4 ZIPLINE
ZIPLINE is a passive backdoor that hijacks an exported function, **accept()**, from the file libsecure.so. When ZIPLINE invokes the hijacked **accept()** function, it first resolves the benign **accept()** from **libc**, to intercept network traffic. Once an incoming connection is registered, it is first processed by the benign **libc\_accept**, and ZIPLINE then checks if the process name is “web”. The malware retrieves up to 21 bytes from the connected host, verifying if the received buffer corresponds to the string “SSH-2.0-OpenSSH\_0.3xx.”  If so, the malicious functionality of ZIPLINE is triggered. ZIPLINE will then receive an encrypted header which specifies the command to be executed.
Figure 7: ZIPLINE support commands.
5.5 WARPWIRE
Multiple new variants of WARPWIRE have been identified in the wild. Across these variants, the primary purpose of them had remained to target plaintext passwords and Usernames for exfiltration to a hard-coded C2 server.
The main change across these variants is how credentials are submitted to the hard-coded C2. In the majority of identified variants, the GET request has been replaced with a POST that submits the credentials in either the POST params or body, however, the variants that have been identified are still utilize a GET request but now include the **window.location.href** as a submitted value.
Based on the number of variants identified as well as suspected mass exploitation of the 
Figure 8: WARPWIRE Variant
Figure 9: WARPWIRE Variant
Figure 10: WARPWIRE Variant
Figure 11: WARPWIRE Variant
**6.0    Recommendation**
Users and administrators are recommended to review the guidance document released by Ivanti, which contains [remediation and hardening recommendations](https://services.google.com/fh/files/misc/ivanti-connect-secure-remediation-hardening.pdf) for suspected compromised Ivanti Connect Secure (CS) VPN appliances associated with the exploitation of CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893 and perform the necessary update. Kindly refer to the below URL:
- <https://services.google.com/fh/files/misc/ivanti-connect-secure-remediation-hardening.pdf>
- <https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US>
Generally, CyberSecurity Malaysia advises users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**7.0    References**
- <https://www.cisa.gov/news-events/alerts/2024/01/30/updated-new-software-updates-and-mitigations-defend-against-exploitation-ivanti-connect-secure-and>
- <https://www.cve.org/CVERecord?id=CVE-2024-21893>
- <https://www.cve.org/CVERecord?id=CVE-2024-21888>
- <https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways>
- <https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day>
- <https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation>
- <https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US>
- <https://services.google.com/fh/files/misc/ivanti-connect-secure-remediation-hardening.pdf>