Ivanti CVEs — PoCs and detection rules¶
14 Ivanti vulnerabilities with detection-only proof-of-concept code and Docker labs; 14 ship ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache). For authorized testing and blue-team detection engineering.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2024-11639 — Ivanti CSA Auth Bypass | Critical (10.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-29824 — Ivanti EPM SQLi | Critical (9.6) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-8963 — Ivanti vTM Auth Bypass | Critical (9.4) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-37404 — Ivanti Endpoint RCE | Critical (9.1) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-22024 — Ivanti Connect XXE | High (8.3) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21893 — Ivanti Connect SSRF | High (8.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21894 — Ivanti Connect Secure Heap Overflow | High (8.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-22026 — Ivanti Connect SSRF | High (7.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-8190 — Ivanti CSA Command Injection | High (7.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-9380 — Ivanti CSA OS Injection | High (7.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-9381 — Ivanti CSA Path Traversal | High (7.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-9379 — Ivanti CSA SQLi | Medium (6.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-22023 — Ivanti Policy Secure XXE | Medium (5.3) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2025-0282 — Connect Secure, Policy Secure, ZTA Gateways | Critical | Snort, YARA, Nginx, Apache | ✅ |