Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add CVE-2023-46805 and CVE-2024-21887 Ivanti Mitigation not applied #8936

Closed
wants to merge 1 commit into from
Closed

add CVE-2023-46805 and CVE-2024-21887 Ivanti Mitigation not applied #8936

wants to merge 1 commit into from

Conversation

h4sh5
Copy link
Contributor

@h4sh5 h4sh5 commented Jan 13, 2024

Template / PR Information

Template Validation

I've validated this template locally?

  • YES
  • NO

Additional Details

shodan query: product:"Pulse Secure"

HTTP request and response when the mitigation isn applied:

curl -v <https://host/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark>
...
< HTTP/1.1 403 Forbidden
< Transfer-Encoding: chunked
< X-XSS-Protection: 1
< Strict-Transport-Security: max-age=31536000
<

the response is empty with a 403 status

when the mitigation is applied:

curl -v <https://host/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark>
...
< HTTP/1.1 403 Forbidden
< Content-Type: text/html; charset=utf-8
< Connection: close
< Pragma: no-cache
< Cache-Control: no-store
< Expires: -1
< Content-Length: 3015
< Strict-Transport-Security: max-age=31536000
<
<!-- Copyright (c) 2022 by Ivanti Inc. All rights reserved -->

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name=robots content="none">
<link rel="icon" href="/dana-na/imgs/Product_favicon.png" type="image/png">
<title>Ivanti&#32;Connect&#32;Secure</title>

..truncated..

<div id="error_message_content"  class="intermediate__content">
Access to the Web site is blocked by your administrator. Please notify your system administrator. Made  request for $request to $host:$port

</div>

..truncated..

</html>

@S0obi
Copy link
Contributor

S0obi commented Jan 15, 2024 •
edited

I was able to test this template on different Pulse Secure and Invanti instances and it seems to work well.

@1angly
Copy link

1angly commented Jan 15, 2024

Hello
As body is equal to '0' i propose this modification.
I test the modification and work well, in my opinion it's more accurate.

matchers-condition: and
matchers:
  - type: dsl
    dsl:
      - "len(body)==0 && status_code==403" # Body length equal to 0 and 403 status code

  - type: word
    negative: true
    words:
      - 'Access to the Web site is blocked by your administrator'

@w2xim3
Copy link

w2xim3 commented Jan 16, 2024 •
edited

This template must check mmh3 icon to remove false positive:
example: www.example.com/dana-na/imgs/Product_favicon.png , value of mmh3 is -1439222863

matchers:
  - type: dsl
    name: "favicon"
    dsl:
      - "status_code==200 && (\"-1439222863\" == mmh3(base64_py(body)))"

@DhiyaneshGeek DhiyaneshGeek self-assigned this Jan 17, 2024
@DhiyaneshGeek DhiyaneshGeek added the Done Ready to merge label Jan 17, 2024
@DhiyaneshGeek DhiyaneshGeek added the duplicate This issue or pull request already exists label Jan 17, 2024
@princechaddha princechaddha reopened this Jan 17, 2024
@princechaddha princechaddha removed duplicate This issue or pull request already exists Done Ready to merge labels Jan 17, 2024
@princechaddha
Copy link
Member

Reopened this PR as we will soon be adding a category for mitigation and patch-related templates. Thank you for your contribution

@S4lt5
Copy link
Contributor

S4lt5 commented Feb 15, 2024

As this sits in the current version it produces a ton of false positives, any WAF/etc will cause it to return positive.

@princechaddha
Copy link
Member

@h4sh5, closing this PR because the template will produce a lot of false positive results. The first matcher is a negative matcher, and the second status method will match all hosts with a 403 status code. We can possibly add an additional request to validate the product first using flow and then use the vulnerable endpoint for mitigation check.

Feel free to reopen this PR if you have a better method for patch detection.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@princechaddha princechaddha Awaiting requested review from princechaddha

Assignees

@DhiyaneshGeek DhiyaneshGeek

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@h4sh5 @S0obi @1angly @w2xim3 @princechaddha @S4lt5 @DhiyaneshGeek