CVE-2024-21887 — A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x)…¶

Key facts

CVE-2024-21887 is a Critical (9.1) vulnerability: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x)…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-01-10), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2024-21887 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-01-10), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2024-01-22. Prioritise patching and deploy the detection and prevention rules below.


CVE	CVE-2024-21887
Severity	Critical (9.1)
CISA KEV	Actively exploited (added 2024-01-10) · ransomware
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-21887/

Details¶

CVE-2024-21887 is a Critical (9.1) vulnerability: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x)…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2024-21887
Type	COMMAND_INJECTION
CVSS Score	9.1

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2024/CVE-2024-21887/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2024-21887

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887

Generated by PoC Generator on 2026-01-03T13:38:26.058114105

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2024-21887, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2024-21887 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-21887 - Snort IDS Rules
# Severity: High

# Detect potential exploit attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-21887 Potential Exploit Attempt";
    flow:to_server,established;
    content:".."; http_uri;
    classtype:web-application-attack;
    sid:2024218871;
    rev:1;
    metadata:cve CVE-2024-21887, severity high;
)

# Detect suspicious patterns in request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-21887 Suspicious Request Pattern";
    flow:to_server,established;
    pcre:"/(%2e%2e|%252e|\x00)/Ui";
    classtype:web-application-attack;
    sid:2024218872;
    rev:1;
    metadata:cve CVE-2024-21887, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-21887 - YARA Detection Rules
 */

rule CVE_2024_21887_Exploit {
    meta:
        description = "Detects potential CVE-2024-21887 exploit attempts"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2024-21887"

    strings:
        $path_traversal1 = "../" ascii wide
        $path_traversal2 = "..\" ascii wide
        $encoded1 = "%2e%2e" ascii wide nocase
        $encoded2 = "%252e" ascii wide nocase
        $null_byte = "%00" ascii wide

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2024-21887 - Prevention Rules for Nginx

# Block common exploit patterns
location / {
    # Rate limiting
    limit_req zone=general burst=20 nodelay;

    # Block suspicious patterns
    if ($request_uri ~* "(\.\.[\/]|%2e%2e|%252e)") {
        return 403;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Log suspicious activity
access_log /var/log/nginx/CVE-2024-21887-access.log;
error_log /var/log/nginx/CVE-2024-21887-error.log;

:material-file-download: prevention/nginx.conf

# CVE-2024-21887 - Prevention Rules for Apache httpd

# Block common exploit patterns
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block path traversal
    RewriteCond %{REQUEST_URI} (\.\.[\/]|%2e%2e|%252e) [NC]
    RewriteRule .* - [F,L]

    # Block null bytes
    RewriteCond %{REQUEST_URI} %00 [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# Enable logging
CustomLog /var/log/httpd/CVE-2024-21887-access.log combined
ErrorLog /var/log/httpd/CVE-2024-21887-error.log

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2024-21887?¶

CVE-2024-21887 is a Critical (9.1) vulnerability: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x)…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-01-10), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2024-21887?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2024-21887?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2024-21887 actively exploited?¶

Yes. CVE-2024-21887 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-01-10, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2024-01-22. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.