Research · Jan 31, 2024 · ZeroDay Catalog
Server-Side Request Forgery Vulnerability in Ivanti Products
A critical server-side request forgery vulnerability has been identified in Ivanti's Connect Secure, Policy Secure, and Neurons products, potentially allowing unauthorized access to restricted resources.
What changed
A server-side request forgery (SSRF) vulnerability has been discovered in the SAML component of Ivanti Connect Secure, Policy Secure, and Neurons. This flaw enables attackers to access restricted resources without proper authentication, posing a significant security risk to affected systems.
Who is affected
Organizations utilizing Ivanti's Connect Secure, Policy Secure, and Neurons products are at risk due to this vulnerability. The impact is particularly concerning for those managing sensitive data and requiring stringent access controls.
- Ivanti Connect Secure (ICS)
- Ivanti Policy Secure
- Ivanti Neurons
- Organizations handling sensitive information
What to do
It is imperative for affected organizations to assess their systems for this vulnerability and implement necessary security measures. Immediate action should include reviewing access controls and applying any available patches or updates provided by Ivanti.