Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Detect
Fingerprints Ivanti Connect Secure and flags CVE-2024-21887 by version. No probe.
Confirm
Unauthenticated GET of system-information. Proves the 46805 bypass half only. No command injection. Advisory
Collect
Merges per-host detect and confirm rows.
Report
Counts checked, product, affected, and confirmed.
Overview
This workflow finds Ivanti Connect Secure and sorts each host by whether its version falls in the CVE-2024-21887 range. CVE-2024-21887 is command injection reached after the CVE-2023-46805 auth bypass. This workflow never sends an injection payload. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public welcome page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that GETs system-information through the totp path. That is the CVE-2023-46805 bypass half. It does not inject a command.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Ivanti Connect Secure from /dana-na/auth/url_default/welcome.cgi, then read the version and compare it to the CVE-2024-21887 floors in the graph.
Confirm only those flagged hosts with an unauthenticated GET of /api/v1/totp/user-backup-code/../../system/system-information. That proves the bypass half. It does not inject a command.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Ivanti Connect Secure was detected, the version read, the affected flag, and whether the bypass-half confirm succeeded.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the welcome page and, on flagged hosts only, the system-information path. No command endpoint.
Sample output
The records below are illustrative and do not come from a real run. They show one Ivanti Connect Secure host inside the CVE-2024-21887 range, one patched host, and one host that is not the product.
Which Ivanti Connect Secure versions does this flag?
9.1 before 9.1R18.3, and 22.x before 22.4R2.2, 22.5R1.1, 22.5R2.2, or 22.6R1.3 on those lines. Those releases and later are the floors the graph treats as not affected. The compare uses the version the product itself served.
Does confirm prove CVE-2024-21887?
No. Confirm only proves the CVE-2023-46805 bypass half: an unauthenticated GET of system-information. It does not send a command-injection payload. A confirmed row means the door that 21887 needs is still open.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of system-information, only on hosts already in range. It does not log in, write files, or inject a command.
Does the check need credentials?
No. It fingerprints the public welcome page the way an external scanner would.
What is CVE-2024-21887?
Command injection in Ivanti Connect Secure reached after the CVE-2023-46805 auth bypass. CISA listed both on KEV. This workflow flags by version, then confirms the bypass half only.