CVE-2023-46805 PoC — Ivanti ICS 授权问题漏洞

Source

https://github.com/cbeek-r7/CVE-2023-46805

Associated Vulnerability

Title: Ivanti ICS 授权问题漏洞 (CVE-2023-46805)
Description:An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Description

Simple scanner for scanning a list of ip-addresses for vulnerable Ivanti Pulse Secure devices

Readme

19/01/2024 ***** Update *******
Updated with the latest info based on Assetnote's blog. 
Now three checks are executed before a status is shown, this also to better detect older versions of Avanti

Blogs with analysis of the CVE:
https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis
https://www.assetnote.io/resources/research/high-signal-detection-and-exploitation-of-ivantis-pulse-connect-secure-auth-bypass-rce

# CVE-2023-46805
Simple scanner for scanning a list of ip-addresses for vulnerable Ivanti Pulse Secure devices

1. Scan a service like Shodan or Censys for the relevant devices and create a list of ip_adresses.
2. Save them to "ip_list.txt" and in the same folder as this script
3. run the script and it will show output to screen and save to a csv file once finished

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →