Ivanti Vulnerability Exploited to Install ‘DSLog’ Backdoor on 670+ IT Infrastructures

Danger actors are leveraging a just lately disclosed security flaw impacting Ivanti Connect Secure, Plan Safe, and ZTA gateways to deploy a backdoor codenamed DSLog on susceptible devices.

That’s according to findings from Orange Cyberdefense, which mentioned it noticed the exploitation of CVE-2024-21893 inside several hours of the public launch of the evidence-the-thought (PoC) code.

CVE-2024-21893, which was disclosed by Ivanti late last month alongside CVE-2024-21888, refers to a server-facet request forgery (SSRF) vulnerability in the SAML module that, if productively exploited, could permit entry to usually limited resources sans any authentication.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The Utah-dependent enterprise has given that acknowledged that the flaw has confined specific attacks, even though the exact scale of the compromises is unclear.

Then, final week, the Shadowserver Basis unveiled a surge in exploitation attempts targeting the vulnerability originating from over 170 unique IP addresses, shortly following equally Speedy7 and AssetNote shared added complex specifics.

Orange Cyberdefense’s hottest evaluation reveals that compromises have been detected as early as February 3, with the attack targeting an unnamed customer to inject a backdoor that grants persistent remote access.

“The backdoor is inserted into an current Perl file named ‘DSLog.pm,'” the firm explained, highlighting an ongoing pattern in which existing legit parts – in this situation, a logging module – are modified to insert the malicious code.

DSLog, the implant, will come fitted with its personal tips to hamper examination and detection, including embedding a exceptional hash per appliance, therefore making it difficult to use the hash to make contact with the identical backdoor on another gadget.

The exact hash worth is provided by the attackers to the User-Agent header field in an HTTP request to the appliance to make it possible for the malware to extract the command to be executed from a query parameter referred to as “cdi.” The decoded instruction is then operate as the root person.

“The web shell does not return standing/code when hoping to call it,” Orange Cyberdefense reported. “There is no known way to detect it immediately.”

It even further observed evidence of threat actors erasing “.access” logs on “various” appliances in a bid to deal with up the forensic path and fly beneath the radar.

But by checking the artifacts that were being created when triggering the SSRF vulnerability, the company said it was equipped to detect 670 compromised assets all through an preliminary scan on February 3, a variety that has dropped to 524 as of February 7.

In light-weight of the ongoing exploitation of Ivanti products, it can be extremely encouraged that “all shoppers factory reset their equipment ahead of implementing the patch to reduce the danger actor from gaining update persistence in your natural environment.”

Found this post interesting? Stick to us on Twitter  and LinkedIn to browse far more exceptional articles we submit.