CVE-2025-0282 — Connect Secure, Policy Secure, ZTA Gateways¶

Q: How do I detect CVE-2025-0282?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

Q: How do I block or mitigate CVE-2025-0282?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Q: Is CVE-2025-0282 actively exploited?

Yes. CVE-2025-0282 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2025-01-08, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2025-01-15. Prioritise patching and deploy the detection and prevention rules above.

Key facts

CVE-2025-0282 (Ivanti) is a Critical vulnerability: Connect Secure, Policy Secure, ZTA Gateways. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-01-08), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2025-0282 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-01-08), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2025-01-15. Prioritise patching and deploy the detection and prevention rules below.


CVE	CVE-2025-0282
Severity	Critical
CISA KEV	Actively exploited (added 2025-01-08) · ransomware
Vendor	Ivanti
Product	Connect Secure, Policy Secure, ZTA Gateways
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2025/CVE-2025-0282/

Details¶

CVE-2025-0282 (Ivanti) is a Critical vulnerability: Connect Secure, Policy Secure, ZTA Gateways. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Ivanti Connect Secure - Stack-Based Buffer Overflow RCE¶

Overview¶

Field	Value
CVE ID	CVE-2025-0282
Severity	Critical (CVSS 9.0)
Vendor	Ivanti
Product	Connect Secure, Policy Secure, ZTA Gateways
Vulnerability Type	Stack-Based Buffer Overflow / RCE
Exploitation	Remote, No Authentication

Description¶

A stack-based buffer overflow vulnerability in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows unauthenticated remote attackers to achieve remote code execution.

Affected Versions¶

Ivanti Connect Secure < 22.7R2.5
Ivanti Policy Secure < 22.7R1.2
Ivanti Neurons for ZTA gateways < 22.7R2.3

Impact¶

Remote Code Execution
Complete system compromise
VPN gateway takeover
Credential theft
Lateral movement into corporate networks

¶

Verification Process¶

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)¶

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing¶

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow¶

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage¶

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References¶

https://nvd.nist.gov/vuln/detail/CVE-2025-0282
https://www.ivanti.com/security
https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Disclaimer¶

This POC is for educational and authorized security testing only.

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2025-0282, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2025-0282 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2025-0282 - Ivanti Connect Secure Snort Detection Rules
# Severity: Critical (CVSS 9.0)

# Detect access to vulnerable Ivanti endpoints
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2025-0282 Ivanti Connect Secure Dana Endpoint Access";
    flow:to_server,established;
    content:"/dana"; http_uri;
    classtype:web-application-attack;
    sid:202502821;
    rev:1;
    metadata:cve CVE-2025-0282, severity critical;
)

# Detect potential buffer overflow payload
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2025-0282 Potential Buffer Overflow Pattern";
    flow:to_server,established;
    content:"|41 41 41 41 41 41 41 41|"; depth:1000;
    byte_test:4,>,500,0,relative;
    classtype:attempted-admin;
    sid:202502822;
    rev:1;
    metadata:cve CVE-2025-0282, severity critical;
)

# Detect IF-T/TLS protocol exploitation
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2025-0282 IF-T Protocol Exploitation Attempt";
    flow:to_server,established;
    content:"/dana-na/"; http_uri;
    content:"Content-Length"; http_header;
    pcre:"/Content-Length:\s*[1-9][0-9]{6,}/Hi";
    classtype:attempted-admin;
    sid:202502823;
    rev:1;
    metadata:cve CVE-2025-0282, severity critical;
)

# Detect web shell access post-exploitation
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS (
    msg:"CVE-2025-0282 Potential Webshell Access";
    flow:to_server,established;
    content:"/dana-na/css/"; http_uri;
    pcre:"/\.(php|jsp|asp|py)(\?|$)/Ui";
    classtype:trojan-activity;
    sid:202502824;
    rev:1;
    metadata:cve CVE-2025-0282, severity critical;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2025-0282 - Ivanti Connect Secure YARA Detection Rules
 * Severity: Critical (CVSS 9.0)
 */

rule CVE_2025_0282_Exploit_Pattern {
    meta:
        description = "Detects CVE-2025-0282 Ivanti exploitation patterns"
        author = "Security Research"
        date = "2025-01-08"
        cve = "CVE-2025-0282"
        severity = "critical"

    strings:
        // Buffer overflow patterns
        $overflow1 = /A{500,}/ ascii
        $overflow2 = /\x41{500,}/ ascii

        // Ivanti/Pulse endpoints
        $uri1 = "/dana-na/" ascii wide
        $uri2 = "/dana/" ascii wide
        $uri3 = "welcome.cgi" ascii wide
        $uri4 = "index.cgi" ascii wide

        // ROP chain indicators
        $rop1 = /[\x00-\xff]{8}[\x00-\xff]{8}[\x00-\xff]{8}/ ascii

    condition:
        (any of ($overflow*) and any of ($uri*)) or
        (filesize < 100KB and any of ($overflow*))
}

rule CVE_2025_0282_Webshell {
    meta:
        description = "Detects webshells deployed via CVE-2025-0282"
        author = "Security Research"
        date = "2025-01-08"
        cve = "CVE-2025-0282"
        severity = "critical"

    strings:
        // Common webshell patterns
        $shell1 = "eval(" ascii wide
        $shell2 = "exec(" ascii wide
        $shell3 = "system(" ascii wide
        $shell4 = "passthru(" ascii wide
        $shell5 = "shell_exec(" ascii wide

        // Ivanti path context
        $path1 = "/dana-na/css/" ascii wide
        $path2 = "/data/runtime/" ascii wide

        // Perl patterns (common in Ivanti)
        $perl1 = "#!/usr/bin/perl" ascii wide
        $perl2 = "use Socket" ascii wide

    condition:
        (2 of ($shell*) and any of ($path*)) or
        (any of ($perl*) and any of ($shell*))
}

rule CVE_2025_0282_Network_IOC {
    meta:
        description = "Network indicators for CVE-2025-0282"
        author = "Security Research"
        date = "2025-01-08"
        cve = "CVE-2025-0282"
        severity = "high"

    strings:
        // HTTP patterns
        $http1 = "POST /dana-na/" ascii wide
        $http2 = "POST /dana/" ascii wide

        // Large content length
        $cl = /Content-Length:\s*[1-9][0-9]{6,}/ ascii nocase

        // Product indicators
        $ivanti1 = "Ivanti" ascii wide nocase
        $ivanti2 = "Pulse" ascii wide nocase
        $ivanti3 = "Connect Secure" ascii wide nocase

    condition:
        any of ($http*) and ($cl or any of ($ivanti*))
}

:material-file-download: prevention/yara.yar

# CVE-2025-0282 - Ivanti Connect Secure Prevention Rules for Nginx

# Block access to vulnerable endpoints
location /dana-na/ {
    # Restrict to trusted networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;

    # Log all access attempts
    access_log /var/log/nginx/ivanti-access.log;
}

location /dana/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

# Block potential buffer overflow payloads
server {
    # Limit request sizes
    client_max_body_size 10M;
    client_body_buffer_size 128k;
    client_header_buffer_size 4k;
    large_client_header_buffers 4 8k;

    # Reject oversized headers
    if ($http_content_length > 10485760) {
        return 413;
    }

    # Block requests with excessive data
    location ~* \.cgi$ {
        # Log CGI access
        access_log /var/log/nginx/cve-2025-0282-cgi.log;

        # Rate limiting
        limit_req zone=ivanti_limit burst=10 nodelay;
    }
}

# Rate limit zone
# limit_req_zone $binary_remote_addr zone=ivanti_limit:10m rate=10r/s;

# Block known malicious patterns
if ($request_uri ~* "(AAAA{100,}|%41{100,})") {
    return 400;
}

# Security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;

:material-file-download: prevention/nginx.conf

# CVE-2025-0282 - Ivanti Connect Secure Prevention Rules for Apache HTTPD

# Block vulnerable Ivanti endpoints
<LocationMatch "^/dana(-na)?/">
    <RequireAll>
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAll>
    CustomLog /var/log/httpd/ivanti-access.log combined
</LocationMatch>

# ModSecurity Rules
<IfModule mod_security2.c>
    # Block buffer overflow patterns
    SecRule REQUEST_BODY "@rx (?:A{500,}|\\x41{500,})" \
        "id:202502821,phase:2,deny,status:400,\
        msg:'CVE-2025-0282 Potential Buffer Overflow Pattern',\
        severity:CRITICAL"

    # Block oversized requests to CGI
    SecRule REQUEST_URI "@rx \.cgi$" \
        "id:202502822,phase:1,chain,deny,status:413,\
        msg:'CVE-2025-0282 Oversized CGI Request'"
        SecRule REQUEST_HEADERS:Content-Length "@gt 1048576" ""

    # Block exploitation attempts
    SecRule REQUEST_URI "@contains /dana" \
        "id:202502823,phase:1,chain,log,\
        msg:'CVE-2025-0282 Dana Endpoint Access'"
        SecRule REQUEST_BODY "@gt 10000" "deny,status:413"
</IfModule>

# Request limits
LimitRequestBody 10485760
LimitRequestLine 8190
LimitRequestFieldSize 8190

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2025-0282?¶