Ivanti Connect Secure / Policy Secure CVE-2023-46805 + CVE-2024-21887 (auth bypass chained with command injection, CISA KEV, Emergency Directive 24-01): how do I check, clean up and rebuild an old gateway?

What it is: In January 2024 Ivanti disclosed two flaws in Ivanti Connect Secure (the former Pulse Secure VPN) and Ivanti Policy Secure: CVE-2023-46805, an authentication bypass in the web component, and CVE-2024-21887, a command injection flaw. Used together they let an attacker with no credentials run commands on the gateway. They were exploited as zero-days, mass-exploited after disclosure, and CISA issued Emergency Directive 24-01, which required not just patching but a factory reset and credential rotation. Follow-up flaws (CVE-2024-21888, CVE-2024-21893, CVE-2024-22024) came in the following weeks, and Ivanti gateways remain a frequent target, so any appliance that skipped this cleanup is still worth checking. Am I affected: - Ivanti Connect Secure 9.x or 22.x, or Ivanti Policy Secure, that hasn't been upgraded to a supported, patched release since early 2024. 9.x has reached end of life. - Check the version on the admin console's System > Maintenance > Platform page and compare with Ivanti's advisory. Fix: 1. Upgrade to a currently supported Connect Secure / Policy Secure release. Old interim mitigations (the 'mitigation.release.20240107.1.xml' import) were only a stopgap; remove them after upgrading as Ivanti's KB describes. 2. Run Ivanti's External Integrity Checker Tool (the external one, not only the built-in checker). It reboots the appliance. 3. Rebuild as CISA directed: export the configuration, factory reset, upgrade to a supported version, then reimport the configuration. If the checker finds anything, take the device offline, preserve forensic images and hunt for further compromise first. 4. Rotate everything the gateway touched: revoke and reissue its certificates and keys, reset the admin enable password, stored API keys and local user passwords, and service accounts for connected authentication servers. Treat linked domain accounts as compromised: reset passwords (twice for on-prem AD, per CISA), revoke Kerberos tickets and cloud tokens. Verify: the appliance runs a supported patched release, the external integrity checker comes back clean, and the old certificates and credentials no longer work. Sources: https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways https://nvd.nist.gov/vuln/detail/CVE-2024-21887