Auth bypass confirmed by traversal to the system-information API without credentials.
Vendor Advisory
Ivanti Fingerprint & Version Check
Detect fingerprints Ivanti Connect Secure and flags CVE-2023-46805 by version. No probe.
Summary Report
Final counts for targets checked, product identified, affected versions, and confirmed bypass.
Target List
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds Ivanti Connect Secure and sorts each host by whether its version falls below the CVE-2023-46805 floors. CVE-2023-46805 is a path traversal that skips the auth filter and reaches protected APIs. This workflow only reads system-information. It does not inject a command and it does not exercise CVE-2024-21887. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public welcome page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that GETs system-information through the totp path without credentials.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Ivanti Connect Secure from /dana-na/auth/url_default/welcome.cgi, then read the version and compare it to the CVE-2023-46805 floors in the graph.
Confirm only those flagged hosts with an unauthenticated GET of /api/v1/totp/user-backup-code/../../system/system-information.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Ivanti Connect Secure was detected, the version read, the affected flag, and whether confirm succeeded.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the welcome page and, on flagged hosts only, the system-information path.
Sample output
The records below are illustrative and do not come from a real run. They show one Ivanti Connect Secure host inside the CVE-2023-46805 range, one patched host, and one host that is not the product.
Which Ivanti Connect Secure versions does this flag?
9.1 before 9.1R18.3, and 22.x before 22.4R2.2, 22.5R1.1, 22.5R2.2, or 22.6R1.3 on those lines. Those releases and later are the floors the graph treats as not affected. The compare uses the version the product itself served.
Does a flagged host mean CVE-2023-46805 was exploited?
A flagged row is patch-lag against the range table. Confirm only an unauthenticated GET of system-information. Treat a confirmed row as evidence the path still answers, not as proof someone already used it.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of system-information, only on hosts already in range. It does not log in, write files, or inject a command.
Does the check need credentials?
No. It fingerprints the public welcome page the way an external scanner would.
What is CVE-2023-46805?
An authentication bypass in Ivanti Connect Secure and Policy Secure via path traversal on the totp API. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms by reading system-information without credentials. It does not chain CVE-2024-21887.