Hackers exploit Ivanti SSRF flaw to deploy new DSLog backdoor

Hackers are exploiting a server-side request forgery (SSRF) vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA gateways to deploy the new DSLog backdoor on vulnerable devices. The vulnerability, tracked as CVE-2024-21893, was disclosed as an actively exploited zero-day on January 31, 2024, with Ivanti sharing security updates and mitigation advice. The flaw impacts the SAML component of the mentioned products and allows attackers to bypass authentication and access restricted resources on Ivanti gateways running versions 9.x and 22.x. The updates that fix the problem are Ivanti Connect Secure versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 and 22.5R2.2, Ivanti Policy Secure version 22.5R1.1, and ZTA version 22.6R1.3. On February 5, 2024, threat monitoring service Shadowserver reported seeing multiple attackers attempting to leverage the flaw, some using proof-of-concept (PoC) exploits previously published by Rapid7, with the success rate being unknown at the time. A new report by Orange Cyberdefense confirms the successful exploitation of CVE-2024-21893 to install a new backdoor named DSLog that allows the threat actors to execute commands on compromised Ivanti servers remotely. Orange says they first spotted this new backdoor on February 3, 2024, after analyzing a compromised appliance that had implemented the Ivanti-proposed XML mitigation (blocking all API endpoints) but hadn't applied the patch. By examining the compromised Invanti device's logs, Or...