Skip to content

Scanner for CVE-2023-46805 - Ivanti Connect Secure

Notifications You must be signed in to change notification settings

yoryio/CVE-2023-46805

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

37 Commits
 
 
 
 

Repository files navigation

CVE-2023-46805 Scanner

CVE-2023-46805 Scanner for possible vulnerable Ivanti Connect Secure appliances by country using Shodan.

Script version: 1.3

Updated with the recent blog post made by Assetnote

⚠️ This script is for defensive purposes and should be used by cybersecurity professionals to identify possible vulnerable ICS appliances and make contact as soon as possible with the affected organizations.

If one of the IPs appeared as a Vulnerable ICS Appliance please apply the mitigations developed by Ivanti also, it's important to check the integrity of your files with the tool Integrity Checker Tool

Help

To use the script, you should have installed the Shodan Python library:

pip install shodan
usage: CVE-2023-46805 Scanner [-h] -c COUNTRY

Quick scanner for possible vulnerable Ivanti Connect Secure appliances by country using Shodan.

options:
  -h, --help            show this help message and exit
  -c COUNTRY, --country COUNTRY
                        Country code (like CL, US, CA, BR)

Please make sure that you are using a valid Shodan API Key

(It's possible to add more than one country to the scan followed by a , without spaces)

Example: python ivanti.py -c US,BR,ES

Shodan

Shodan Query: http.favicon.hash:-1439222863 country:country_code

Vulnerability Intelligence

Please refer to the following CVEs for more information:

  • CVSS: 8.2
  • Impact: Authentication Bypass
  • Description: Allows a remote attacker to access restricted resources by bypassing control checks.
  • CVSS: 9.1
  • Impact: Command Injection
  • Description: Allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Based on the blog post by watchTowr Labs!:

Welcome To 2024, The SSLVPN Chaos Continues - Ivanti CVE-2023-46805 & CVE-2024-21887

At the moment, the vulnerabilites are being exploited massively:

Volexity - Ivanti Connect Secure VPN Exploitation Goes Global

By: yoryio

About

Scanner for CVE-2023-46805 - Ivanti Connect Secure

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages