Ivanti CSA Exploit Chains Under Active Exploitation

Threat actors exploited a chain of four vulnerabilities in Ivanti Cloud Service Appliance (CSA) 4.6 between September and October 2024, chaining authentication bypass, SQL injection, and remote code execution flaws to deploy webshells and exfiltrate credentials. The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory confirming the exploitation of CVE-2024-8963, CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380. All four vulnerabilities affect CSA 4.6x versions before patch 519, a release line now end-of-life with no further patches or third-party library updates. CISA has added all four CVEs to its Known Exploited Vulnerabilities (KEV) Catalog.

The Vulnerability Chain

The attack sequence began with CVE-2024-8963 (CWE-22: Path Traversal), an administrative bypass that allowed unauthenticated remote access to restricted appliance features. According to the CISA-FBI advisory, threat actors leveraged this flaw in two distinct exploit chains. In the first chain, CVE-2024-8963 was combined with CVE-2024-8190 (CWE-78: OS Command Injection) and CVE-2024-9380 (CWE-77: Command Injection). The second chain paired CVE-2024-8963 with CVE-2024-9379 (CWE-89: SQL Injection).

After bypassing authentication via CVE-2024-8963, actors executed arbitrary commands through the RCE flaws. In confirmed compromises, actors sent a GET request to datetime.php to acquire session and CSRF tokens, followed by a POST request to the same endpoint. The TIMEZONE input field manipulated the setSystemTimeZone function, executing base64-encoded Python scripts that harvested encrypted admin credentials from the database. In some cases, actors exfiltrated encrypted credentials for offline decryption; in others, they leveraged a binary matching php\w{6} in the /tmp directory.

This is not the first time Ivanti appliances have been targeted by sophisticated exploit chains. Recent Ivanti vulnerabilities demonstrate that attackers systematically probe vendor appliances for authentication bypass and RCE flaws. Attack patterns show that once actors establish an initial foothold through authentication bypass, they quickly pivot to credential harvesting and persistence mechanisms. The use of base64-encoded scripts serves two purposes: evading basic signature-based detection and obfuscating the true intent of the malicious payload. Actors used multiple script variations, indicating iterative refinement of the exploit code during the campaign.

Affected Versions and End-of-Life Reality

All four vulnerabilities impact Ivanti CSA version 4.6x releases before patch 519. Two of the flaws—CVE-2024-9379 and CVE-2024-9380—also affect CSA 5.0.1 and below, though Ivanti reports no exploitation against version 5.0. The critical issue: CSA 4.6 is end-of-life. No patches, no third-party library updates, no security support. Organizations still running CSA 4.6 must upgrade to CSA 5.0 or decommission the appliance. Continuing to operate an EOL system with known zero-day exploit chains in the wild is indefensible risk.

End-of-life software in enterprise environments represents a persistent attack surface that threat actors actively probe and exploit. CSA 4.6 reached its end-of-life status prior to the discovery of these vulnerabilities, meaning Ivanti has no obligation or capability to release patches. This creates a forced migration scenario for organizations that have delayed upgrades. The delay comes with material consequences: once a vulnerability is disclosed and added to the KEV Catalog, attackers increase their scanning and exploitation efforts against unpatched instances.

Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must remediate vulnerabilities in the KEV Catalog by specified due dates. BOD 22-01 has been superseded by BOD 26-04, but the accelerated remediation mandate remains. For commercial organizations, the KEV Catalog serves as a prioritization signal—if CISA flags a flaw as actively exploited, treat it accordingly. The directive establishes strict remediation timelines based on vulnerability severity, requiring agencies to patch within days or weeks depending on the criticality of the flaw.

The CISA directive serves as an authoritative source for vulnerability prioritization. Rather than relying solely on CVSS scores, which measure theoretical severity, the KEV Catalog reflects real-world exploitation activity. CVE-2024-8963, CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380 all appear in the catalog because evidence confirms active exploitation. This elevates their remediation priority above vulnerabilities with higher CVSS scores but no confirmed exploitation.

Detection and Incident Response

CISA and the FBI provide indicators of compromise (IOCs) and detection methodologies in their advisory. Network defenders should hunt for webshell files, suspicious binaries in /tmp, and anomalous administrative activity on CSA appliances. Given credential exfiltration, any credentials stored on affected appliances should be considered compromised. Perform forced password resets and audit privileged account access patterns.

Search for processes matching the php\w{6} pattern in temporary directories. Review access logs for requests to datetime.php with unusual TIMEZONE parameter payloads. Collect forensic artifacts and analyze them for evidence of lateral movement. In one confirmed compromise, actors moved laterally to two servers after initial access. Assume that any system reachable from the compromised CSA may have been touched.

Detection requires a multi-layered approach. Network-level monitoring can identify the initial exploitation attempts by detecting unusual request patterns to the CSA management interface. Endpoint monitoring should focus on process creation in temporary directories and unauthorized file modifications. For organizations with SIEM capabilities, create correlation rules that flag successful administrative logins followed immediately by process execution in system directories.

Incident response for these exploit chains follows a standard pattern: isolate the affected CSA appliance, preserve forensic evidence, rotate all credentials that may have been stored on the device, and conduct a thorough investigation for lateral movement. Because CSA appliances often hold privileged credentials for other systems, the blast radius of a compromise can extend far beyond the appliance itself. Do not assume that isolating the CSA stops the attack—actors may have already established persistence on other systems using harvested credentials.

Remediation Path

For organizations running CSA 4.6, there is only one viable remediation path: upgrade to CSA 5.0. Patch 519 for 4.6x does not resolve the authentication bypass in CVE-2024-8963. Ivanti explicitly states that CSA 5.0 is not vulnerable to the exploit chains observed in the wild. Plan and execute the migration immediately. The alternative—decommissioning the CSA appliance—may be preferable if CSA 5.0 does not fit your architecture or if you can achieve the same functionality through alternative means.

For CSA 5.0 deployments, apply updates to address CVE-2024-9379 and CVE-2024-9380. Confirm that you are running a version beyond 5.0.1. Validate that no EOL CSA 4.6 instances remain in your inventory. Conduct an inventory sweep of internet-exposed management interfaces and retire any that cannot be patched or upgraded.

Migrating from CSA 4.6 to CSA 5.0 involves more than a simple software update. The two versions may have different configuration schemas, authentication mechanisms, and integration points. Test the migration process in a non-production environment first. Validate that all required functionality works after migration before decommissioning the legacy appliance. Document the configuration and any customizations before beginning the migration to ensure nothing is lost in transit.

Organizations that cannot upgrade or migrate should decommission CSA 4.6 immediately and transition to alternative solutions. Leaving an EOL system exposed on the network, especially one with known active exploitation, is not an acceptable risk posture. The cost of migrating or replacing the appliance is far lower than the potential cost of a breach that results from continued operation of vulnerable infrastructure.

References

• CISA and FBI Joint Cybersecurity Advisory: Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications (AA25-022A)
• CISA Urges Agencies to Upgrade or Remove End-of-Life Ivanti Appliance
• FBI IC3 Report: Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications (PDF)
• CISA Known Exploited Vulnerabilities Catalog
• NIST NVD: CVE-2024-8963 (Path Traversal in Ivanti CSA 4.6)