{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awpmetwp_ultimate_reviewwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:9.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:9.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*","cpe:2.3:a:wpmet:wp_ultimate_review:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2023-46805"},{"cvss":9.1,"id":"CVE-2024-21887"},{"cvss":4.3,"id":"CVE-2023-46085"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Connect Secure"],"_cs_severities":["high"],"_cs_tags":["ivanti","cve-2023-46805","cve-2024-21887","vpn","exploitation","command-injection","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Ivanti"],"content_html":"\u003cp\u003eThis threat brief addresses exploitation attempts targeting Ivanti Connect Secure VPN appliances, specifically focusing on CVE-2023-46805 and CVE-2024-21887. These vulnerabilities allow for authentication bypass and command injection, potentially leading to unauthenticated remote code execution. The attacks target a specific endpoint related to web bookmarks, \u003ccode\u003e/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark\u003c/code\u003e. Detection focuses on identifying anomalous GET requests to this endpoint that result in a 403 Forbidden response. Successful exploitation grants attackers unauthorized access to the system, allowing them to execute commands, steal sensitive data, or deploy malicious payloads. Due to the critical nature of VPN appliances in network security, defenders must prioritize detecting and mitigating these exploitation attempts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker sends a crafted GET request to the vulnerable endpoint: \u003ccode\u003e/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerabilities (CVE-2023-46805 and CVE-2024-21887), the authentication checks are bypassed.\u003c/li\u003e\n\u003cli\u003eThe server processes the malicious request and attempts to access or modify web bookmark configurations.\u003c/li\u003e\n\u003cli\u003eDue to improper input validation, a command injection vulnerability is triggered, allowing the attacker to inject arbitrary commands.\u003c/li\u003e\n\u003cli\u003eThe server returns a \u003ccode\u003e403 Forbidden\u003c/code\u003e HTTP status code, indicating the request was blocked after the attempted exploitation. The response body is often empty.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the command execution to perform reconnaissance activities, such as gathering system information using tools like \u003ccode\u003euname\u003c/code\u003e or \u003ccode\u003eipconfig\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to establish persistence by creating new user accounts or modifying existing VPN configurations.\u003c/li\u003e\n\u003cli\u003eFinally, the attacker achieves their objective, which may include data exfiltration, lateral movement within the network, or deploying ransomware.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2023-46805 and CVE-2024-21887 can lead to complete compromise of the Ivanti Connect Secure VPN appliance. This can result in unauthorized access to sensitive internal resources, data breaches, and disruption of VPN services. Given that VPNs are a critical component of network security, a successful attack can have widespread consequences. The number of affected organizations is potentially very high, with victims spanning multiple sectors, including government, finance, and critical infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Ivanti Connect Secure Bookmark Endpoint Access\u003c/code\u003e to identify potential exploitation attempts based on HTTP GET requests with 403 responses targeting the specific bookmark endpoint.\u003c/li\u003e\n\u003cli\u003eInspect web server logs for requests matching the pattern \u003ccode\u003e*/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark*\u003c/code\u003e with a \u003ccode\u003e403\u003c/code\u003e status code, as described in the overview.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts triggered by the provided Sigma rule or identified through manual log analysis, focusing on the source IP address (\u003ccode\u003eWeb.src\u003c/code\u003e in the provided search query) and destination system (\u003ccode\u003eWeb.dest\u003c/code\u003e in the provided search query).\u003c/li\u003e\n\u003cli\u003eApply the official patches and mitigations provided by Ivanti for CVE-2023-46805 and CVE-2024-21887 on all affected Ivanti Connect Secure VPN appliances immediately, as this is the most effective way to prevent exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T17:40:53Z","date_published":"2024-04-29T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-04-ivanti-connect-secure-bookmark-endpoint/","summary":"Detection of access to the Ivanti Connect Secure bookmark endpoint associated with CVE-2023-46805 and CVE-2024-21887 via a GET request resulting in a 403 Forbidden response indicates a potential exploitation attempt.","title":"Detection of Exploitation Attempts Targeting Ivanti Connect Secure Bookmark Endpoint Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2024-04-ivanti-connect-secure-bookmark-endpoint/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wpmet:wp_ultimate_review:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}