[Update] Multiple vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (January 11, 2024)

* Risks include circumvention of security policy, arbitrary remote code execution, and privilege escalation.
* Affected systems are Ivanti Connect Secure (ICS), Ivanti Neurons for ZTA gateways, and Ivanti Policy Secure gateways across all versions.
* Vulnerability CVE-2024-22024 was added on February 9, 2024.
* The vulnerability allowed an unauthenticated attacker to access restricted resources.
* Vulnerabilities CVE-2024-21888 and CVE-2024-21893 allow for privilege escalation and Server-Side Request Forgery (SSRF) via the SAML component.
* Vulnerabilities CVE-2023-46805 and CVE-2024-21887 allow an attacker to bypass authentication and execute arbitrary commands, respectively.
* Patches were published for specific versions of Ivanti Connect Secure, Policy Secure, and ZTA gateways.
* A workaround measure (mitigation.release.20240126.5.xml) was provided to protect against CVE-2024-21888 and CVE-2024-21893.
* The vendor recommended that customers using virtual machines should start from an image (template) instead of factory resetting.
* If a patch was applied between January 31st and February 1st, performing a backup, scanning the external ICS, and potentially a factory reset was recommended before patching.

The dynamic interplay between vendor disclosure, active exploitation tracking, and mitigation strategy reveals a specific pattern in vulnerability management under duress. The sequence of releasing patches for specific versions followed by the public disclosure and mass exploitation of associated zero-day vulnerabilities suggests a system where defensive measures are reactive rather than proactive. The provision of an XML workaround, which itself has noted potential internal service malfunctions if not properly managed, introduces a new layer of risk: balancing immediate threat mitigation against operational stability. This creates a tension between speed of response and long-term integrity. The recommendation to transition from factory resets to image-based deployments suggests that the inherent statefulness or configuration stored on compromised equipment is now considered an unacceptable liability, shifting the focus from remediation of an infected state to reconstruction from a trusted baseline. The pattern indicates that when underlying trust mechanisms are broken through exploitable flaws, the solution moves from patching lines of code to resetting the entire operational context.
Bridge Questions: If the vendor's guidance on applying workarounds carries inherent risk regarding internal service function, how should organizations establish an independent validation framework for accepting such mitigations? What long-term architectural shifts are required to prevent reliance on legacy systems where configuration recovery hinges on restoring potentially tainted states? How can incident response protocols be standardized to rapidly assess and act upon the integration of external indicators, such as those from CERT-FR, without introducing decision paralysis?