How to remediate – Ivanti Policy Secure Detection

1. Introduction

Ivanti Policy Secure Detection indicates that the web interface for Ivanti Policy Secure, previously known as Pulse Policy Secure, is present on a remote host. This network access control (NAC) server manages access to networks and systems. Its exposure can allow attackers to probe for vulnerabilities and potentially gain unauthorized access. A successful exploit could compromise confidentiality, integrity, and availability of the network.

2. Technical Explanation

The vulnerability lies in the presence of the Ivanti Policy Secure web interface, which may contain known or unknown security flaws. Attackers can attempt to exploit these flaws remotely. Nessus attempts to retrieve version information without credentials; with HTTP credentials, it will try to access the Admin console first.

• Root cause: The presence of a potentially vulnerable web interface on the network.
• Exploit mechanism: Attackers can probe for vulnerabilities in the web interface using automated tools or manual techniques.
• Scope: Ivanti Policy Secure (formerly Pulse Policy Secure) servers are affected.

3. Detection and Assessment

Confirming vulnerability involves identifying instances of the Ivanti Policy Secure web interface on your network. A quick check can be done by examining running services, while a thorough method includes scanning for specific signatures.

• Quick checks: Use netstat -tulnp or similar commands to identify processes listening on ports commonly used by Ivanti Policy Secure (e.g., 443, 80).
• Scanning: Nessus plugin ID can be used for detection.
• Logs and evidence: Review web server logs for access attempts targeting the Ivanti Policy Secure interface.

netstat -tulnp | grep :443

4. Solution / Remediation Steps

The primary solution is to ensure Ivanti Policy Secure is patched and properly configured according to vendor recommendations.

4.1 Preparation

• Stopping the Ivanti Policy Secure service may be required for some updates. A roll back plan involves restoring from backup or reverting configurations.

4.2 Implementation

1. Step 1: Review Ivanti’s security advisories for applicable patches and updates at https://www.ivanti.com/products/network-access-control
2. Step 2: Download and install the latest patch or update according to Ivanti’s documentation.

4.3 Config or Code Example

No configuration change is required for this detection, but ensure secure configurations are in place based on vendor recommendations.

Before

N/A - This is a detection of the presence of a service

After

Ensure Ivanti Policy Secure is running the latest version.

4.4 Security Practices Relevant to This Vulnerability

Practices like least privilege and patch cadence are relevant to this vulnerability type. Least privilege limits the impact of a potential exploit, while regular patching ensures systems have the latest security fixes.

• Practice 1: Implement least privilege principles for all accounts accessing Ivanti Policy Secure.
• Practice 2: Establish a consistent patch cadence to apply security updates promptly.

4.5 Automation (Optional)

Automation scripts can be used to check the version of Ivanti Policy Secure across multiple systems.

# Example PowerShell script for checking Ivanti Policy Secure version
# Requires appropriate permissions and network access
Invoke-WebRequest -Uri "https://your_ivanti_policy_secure_ip/admin" -UseBasicParsing | Select-String -Pattern "Version:.*?"

5. Verification / Validation

Confirm the fix by verifying that Ivanti Policy Secure is running the latest version and re-running the detection scan to ensure it no longer identifies a vulnerable instance. A smoke test should confirm core functionality remains operational.

• Post-fix check: Run netstat -tulnp | grep :443 and verify that the Ivanti Policy Secure version information is current.
• Re-test: Re-run the Nessus scan to confirm the vulnerability is no longer detected.

netstat -tulnp | grep :443

6. Preventive Measures and Monitoring

Update security baselines to include the latest Ivanti Policy Secure version requirements. Implement checks in CI/CD pipelines to prevent deployment of vulnerable versions.

• Baselines: Update security baselines or policies to require the latest Ivanti Policy Secure version.
• Pipelines: Add vulnerability scanning to CI/CD pipelines to identify and block deployments of vulnerable systems.

7. Risks, Side Effects, and Roll Back

Patching may cause temporary service disruptions. A roll back plan involves restoring from backup or reverting configurations.

• Risk or side effect 1: Patching could temporarily interrupt network access.

8. References and Resources

Refer to official Ivanti advisories for detailed information on this vulnerability and available fixes.

• Vendor advisory or bulletin: https://www.ivanti.com/products/network-access-control