Cyber

What changed

A command injection vulnerability has been discovered in the web components of Ivanti Connect Secure and Ivanti Policy Secure. This flaw allows authenticated administrators to send specially crafted requests that could execute arbitrary code on the affected systems.

This vulnerability is particularly concerning as it can be exploited in conjunction with CVE-2023-46805, which involves an authenticated bypass issue, further increasing the risk of unauthorized access.

Who is affected

Organizations utilizing Ivanti Connect Secure (ICS) and Ivanti Policy Secure are at risk due to this vulnerability. These products are widely used for secure remote access and network policy management.

The following groups are particularly vulnerable:

• Enterprises relying on Ivanti for secure connectivity solutions.
• IT departments managing remote access for employees.
• Organizations that integrate Ivanti products with other security solutions.
• Service providers offering Ivanti-based services to clients.

What to do

It is crucial for affected organizations to assess their systems for the presence of this vulnerability. Immediate action should be taken to mitigate potential risks.

Administrators should apply any available patches from Ivanti and review security configurations to prevent exploitation.

• Update Ivanti Connect Secure and Policy Secure to the latest versions as soon as patches are released.
• Review and tighten access controls for administrative interfaces.
• Monitor logs for any suspicious activity that may indicate attempts to exploit this vulnerability.
• Stay informed about further updates from Ivanti regarding this and related vulnerabilities.

What changed

A vulnerability has been discovered in the tj-actions/changed-files GitHub Action, which allows for command injection through output filenames. This flaw can enable an attacker to execute arbitrary code and may lead to the exposure of sensitive information.

The issue arises from the action's handling of filenames, which are not adequately sanitized beyond JSON escaping. This oversight can be exploited to include special characters that could trigger command execution.

Who is affected

Users of the tj-actions/changed-files GitHub Action are at risk due to this vulnerability. The following groups are particularly affected:

Developers utilizing GitHub Actions for CI/CD pipelines may inadvertently expose their workflows to this risk.

• Organizations using tj-actions/changed-files for tracking file changes in commits or pull requests.
• Developers who rely on automated workflows that incorporate this action.
• Security teams monitoring GitHub Actions for vulnerabilities in their CI/CD processes.

What to do

It is crucial for users of tj-actions/changed-files to review their workflows and assess the potential impact of this vulnerability. Immediate action is recommended to mitigate risks.

Consider disabling the action or implementing additional input validation to prevent command injection. Regularly monitor for updates or patches from the maintainers of tj-actions.

• Review and update workflows that utilize tj-actions/changed-files.
• Implement strict input validation to sanitize filenames.
• Stay informed about updates from tj-actions regarding this vulnerability.