Full Report
Detect and mitigate CVE-2025-0282, a critical RCE vulnerability in Ivanti Connect Secure and CVE-2025-0283, exploited as 0day vulnerabilities in the wild. Organizations should patch urgently.
Analysis Summary
# Vulnerability: Active Exploitation of Zero-Day RCE in Ivanti Connect Secure VPN
## CVE Details
- CVE ID: CVE-2025-0282, CVE-2025-0283
- CVSS Score: Not explicitly provided, but **CVE-2025-0282** is a zero-day allowing unauthenticated RCE, implying High/Critical severity.
- CWE: Stack-based buffer overflow (for CVE-2025-0282)
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS), Ivanti Policy Secure, Ivanti Neurons for ZTA Gateways.
- **Versions:**
* **CVE-2025-0282:**
* ICS: Versions `22.7R2` through `22.7R2.4`
* Policy Secure: Versions `22.7R1` through `22.7R1.2`
* Neurons for ZTA Gateways: Versions `22.7R2` through `22.7R2.3`
* **CVE-2025-0283:**
* ICS: Versions `22.7R2.4` and prior, `9.1R18.9` and prior
* Policy Secure: Versions `22.7R1.2` and prior
* Neurons for ZTA Gateways: Versions `22.7R2.3` and prior
- **Configurations:** Affects the VPN appliances themselves. Exploitation requires reconnaissance to determine the exact appliance version.
## Vulnerability Description
**CVE-2025-0282** is an unauthenticated stack-based buffer overflow vulnerability. Attackers exploit this by sending specially crafted inputs to overwhelm the memory buffer, leading to remote arbitrary code execution and potential complete system control.
**CVE-2025-0283** details are less specific but are suspected to involve privilege escalation or input validation issues, likely used to amplify the impact of CVE-2025-0282 or gain higher privileges post-exploitation.
## Exploitation
- **Status:** **Exploited in the wild** (Since December 2024)
- **Complexity:** Low (for CVE-2025-0282, as it is unauthenticated RCE)
- **Attack Vector:** Network
**Observed Exploitation Chain (CVE-2025-0282):**
1. Reconnaissance to identify the ICS appliance version via specific URL queries.
2. Sending a crafted payload to trigger the stack-based buffer overflow for RCE.
3. Post-exploitation steps include disabling SELinux, remounting filesystems, injecting web shells (PHASEJAM), deploying backdoors (DRYHOOK, SPAWNSNAIL, SPWANMOLE, SPAWNANT), tampering with logs (SPAWNSLOTH), and exfiltrating credentials and session cookies. Internal reconnaissance using tools like nmap and dig is also observed.
## Impact
- **Confidentiality:** High (Credential theft, data exfiltration, access to session tokens)
- **Integrity:** High (System configuration modification, malware deployment, disabling security controls like SELinux)
- **Availability:** Medium/High (Potential denial of service, system manipulation)
## Remediation
### Patches
- Ivanti strongly recommends upgrading to the latest available versions. Specific patched versions are not detailed here, but customers should consult the vendor advisory for the current, fixed version, which is implied to be newer than those listed as vulnerable (e.g., the factory reset recommendation points toward version `22.7R2.5`).
### Workarounds
- Use Ivanti's Integrity Checker Tool (ICT) to identify suspicious activity.
- If ICT scans indicate compromise, **perform a factory reset** and reinstall using version `22.7R2.5`.
- Contact Ivanti Support if compromise is suspected.
## Detection
- **Indicators of Compromise (IOCs):**
* Presence of known malware files/families: DRYHOOK, PHASEJAM, SPAWNSNAIL, SPWANMOLE, SPAWNANT, SPWANSLOTH.
* Specific Web Shell paths installed: `/home/webserver/htdocs/dana-na/auth/getComponent.cgi` or `/home/webserver/htdocs/dana-na/auth/restAuth.cgi`.
* Loading of specific shared libraries from `/root/home/lib/` or `/root/lib/`.
- **Detection Methods and Tools:**
* Utilize vendor-provided Integrity Checker Tool (ICT).
* Cloud security platforms (e.g., Wiz customers) can use pre-built queries to identify vulnerable instances.
* Monitor for outbound connections originating from the appliance related to reconnaissance (`nmap`, `dig`) or tunneling activity.
* Check for modifications to system files, disabled SELinux status, and suspicious files in `/tmp/`.
## References
- Mandiant blog: cloud dot google dot com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
- Ivanti advisory: www dot ivanti dot com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways