{"uuid": "dfbabc79-1dd0-4920-bf18-dc23d9a1778c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-46805", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module chains an authentication bypass vulnerability (CVE-2023-46805) and a command injection\\n          vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti\\n          Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and\\n          22.x prior to the vendor mitigation are vulnerable. It is unknown if unsupported versions 8.x and below are\\n          also vulnerable.\", \"disclosure_date\": \"2024-01-10\", \"fullname\": \"exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"Ivanti Connect Secure Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/ivanti_connect_secure_rce_cve_2023_46805\", \"references\": [\"CVE-2023-46805\", \"CVE-2024-21887\", \"URL-https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis\", \"URL-https://labs.watchtowr.com/welcome-to-2024-the-sslvpn-chaos-continues-ivanti-cve-2023-46805-cve-2024-21887/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:39.694529Z"}