Ivanti Vulnerability Exploited to Install 'DSLog' Backdoor on 670+ IT Infrastructures

🗓️ 13 Feb 2024 07:03:00Reported by The Hacker NewsType

Ivanti Vulnerability Exploited to Install 'DSLog' Backdoor on 670+ IT Infrastructures. Threat actors deploying DSLog backdoor using Ivanti Connect Secure, Policy Secure, and ZTA gateways. Exploitation of SSRF vulnerability (CVE-2024-21893) observed immediately after PoC release. Backdoor inserted into existing Perl file to grant persistent remote access. DSLog implant uses unique hash per appliance and concealed web shell to avoid detection

Reporter	Title	Published	Views	Family All 169
zdt	Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit	22 Jan 202400:00	–	zdt
zdt	Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit	21 Feb 202400:00	–	zdt
githubexploit	Exploit for Command Injection in Ivanti Connect_Secure	20 Jan 202419:15	–	githubexploit
githubexploit	Exploit for Improper Authentication in Ivanti Connect_Secure	16 Jan 202408:05	–	githubexploit
githubexploit	Exploit for Improper Authentication in Ivanti Connect_Secure	18 Jan 202413:25	–	githubexploit
githubexploit	Exploit for Command Injection in Ivanti Connect_Secure	3 Feb 202411:33	–	githubexploit
githubexploit	Exploit for Improper Authentication in Ivanti Connect_Secure	14 Jan 202418:30	–	githubexploit
githubexploit	Exploit for Command Injection in Ivanti Connect_Secure	14 Jan 202409:25	–	githubexploit
githubexploit	Exploit for Improper Authentication in Ivanti Connect_Secure	14 Jan 202418:30	–	githubexploit
githubexploit	Exploit for Server-Side Request Forgery in Ivanti Connect_Secure	2 Feb 202422:59	–	githubexploit

13 Feb 2024 07:03Current

7.4High risk

Vulners AI Score7.4

CVSS 3.19.1

CVSS 39.1

EPSS0.99999

SSVC