## https://sploitus.com/exploit?id=8335387E-4150-5D59-B869-3CCE0A7A6F7F
# CVE-2025-0282 โ Ivanti Connect Secure / Policy Secure / ZTA Gateways Stack-Based Buffer Overflow RCE
**CVSS 9.0 โ CRITICAL** | **Actively Exploited Zero-Day** | **Discovered January 2025**
---
## Overview
CVE-2025-0282 is a **stack-based buffer overflow vulnerability** (CWE-121 / CWE-787) in the IFT/TLS handling component of Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti ZTA Gateways. The flaw allows an unauthenticated, remote attacker to achieve **arbitrary code execution** on the target appliance with root privileges.
The vulnerability was disclosed on **January 8, 2025** after being observed in active exploitation as a zero-day. It was attributed to the China-nexus threat actor tracked as **UNC5337** by Mandiant. CISA added this CVE to its **Known Exploited Vulnerabilities (KEV) catalog** within 72 hours of public disclosure.
---
## Technical Details
### Root Cause
The vulnerability resides in the **IFT (Internal Forwarding Table) / TLS packet processing** path of the appliance's HTTPS management interface. When parsing malformed TLS handshake messages or specially crafted IFT frames, the code copies attacker-controlled data into a fixed-size stack buffer without proper bounds checking:
```
memcpy(stack_buffer, attacker_data, attacker_controlled_length); // no length check
```
Because the destination buffer resides on the stack, an oversized payload overwrites:
- **Local variables** โ can alter program logic
- **Saved return address (RIP/RA)** โ enables ROP or direct code execution
- **SEH chain (Windows-based versions)** โ enables SEH overwrite
### Attack Vector
| Field | Detail |
|------------------|----------------------------------------------|
| **Vector** | Network |
| **Complexity** | Low |
| **Privileges** | None |
| **User Interaction** | None |
| **Scope** | Unchanged |
| **Confidentiality** | High |
| **Integrity** | High |
| **Availability** | High |
### Exploitation Characteristics
- Full chain does **not** require authentication
- Exploitation occurs at the **TLS handshake** stage, before application-layer authentication
- Public PoC code leverages a large physical frame size field (>65535 bytes) in a crafted TLS record to overflow a 1024-byte stack buffer
- Successful exploitation provides a **root shell** on the appliance
- Post-exploitation activity by UNC5337 included credential dumping, tunnel installation, and lateral movement
---
## Affected Versions
| Product | Affected Versions | Fixed Version |
|-----------------------|----------------------------------|------------------|
| Ivanti Connect Secure | **Note:** Ivanti has confirmed that the **22.6** release line is also vulnerable. Customers still on ICS 9.x or 22.4 are equally exposed.
### Detection Indicators
- Unexpected TLS handshake sizes in HTTPS management interface logs
- Processes crashing with access violations on `sslvpn` or `dsaccess` services
- Unscheduled appliance reboots
- Presence of files such as `/tmp/*.py`, `.sslvpn_config_upload`, or unexpected cron entries
- Outbound connections from the appliance to IPs associated with UNC5337 infrastructure
---
## Reproduction Steps
### Prerequisites
- Python 3.8+
- A target Ivanti appliance (authorized test environment only)
- Network access to the HTTPS management interface (port 8443 by default)
- `scapy`, `socket`, and `ssl` Python modules
### Setup
1. Clone this repository:
```bash
git clone https://github.com/your-org/cve-2025-0282-reproduction
cd cve-2025-0282-reproduction
```
2. Install dependencies:
```bash
pip install -r requirements.txt
```
*(Requirements: `scapy`, `argparse`, `socket` โ socket is stdlib)*
### Execution
1. Run the PoC against your target:
```bash
python exploit.py --target 192.168.1.100 --port 8443
```
2. To specify a custom payload size:
```bash
python exploit.py --target 192.168.1.100 --port 8443 --payload-size 4096
```
3. Enable debug output:
```bash
python exploit.py --target 192.168.1.100 --port 8443 --verbose
```
### What the PoC Does
1. Opens a TCP connection to the target's HTTPS management interface
2. Sends a standard TLS ClientHello
3. On receiving the ServerHello, the PoC injects a **malformed TLS record** with an oversized IFT frame size field
4. This malformed record triggers the `memcpy` into a 1024-byte stack buffer without bounds checking
5. The overflow corrupts the stack, providing a **proof-of-concept crash** (segmentation fault or access violation)
6. In a full exploit, this crash would be replaced with a ROP chain that executes arbitrary code
> **Important:** The code provided is for **educational and authorized testing only**. It demonstrates the buffer overflow condition and will cause a denial of service (crash) on unpatched targets. Running this against systems you do not own or have written permission to test is illegal.
---
## PoC Code
See [`exploit.py`](./exploit.py) in this repository.
The script accepts the following arguments:
```
usage: exploit.py [-h] --target TARGET [--port PORT] [--payload-size PAYLOAD_SIZE] [--verbose]
CVE-2025-0282 Ivanti Stack Buffer Overflow Reproduction PoC
options:
-h, --help show this help message and exit
--target TARGET Target Ivanti appliance IP or hostname
--port PORT Target port (default: 8443)
--payload-size PAYLOAD_SIZE
Size of overflow payload in bytes (default: 4096)
--verbose Enable verbose/debug output
```
---
## Mitigation
| Action | Detail |
|-----------------------------|-----------------------------------------------------------|
| **Patch immediately** | Upgrade to ICS >=22.7R2.5, IPS >=22.7R1.2, ZTA >=22.7R2.3 |
| **Restrict network access** | Limit HTTPS management interface to trusted IPs only |
| **Enable MFA** | Mitigates post-exploitation lateral movement |
| **Monitor logs** | Watch for TLS anomalies and unexpected process crashes |
| **Hunt for IOCs** | Check for UNC5337 TTPs (credential dumping, tunnel tools) |
### Workarounds (if patching is delayed)
- Deploy a WAF/IPS with a TLS record-size check rule in front of the management interface
- Disable the management interface on external-facing network interfaces
- Use Ivanti's **External Integrity Checker (IC)** tool to verify appliance integrity
---
## References
- [NIST NVD CVE-2025-0282](https://nvd.nist.gov/vuln/detail/CVE-2025-0282)
- [CISA KEV CVE-2025-0282](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Mandiant / UNC5337 Analysis](https://www.mandiant.com/resources/blog/unc5337-ivanti-exploitation)
- [Ivanti Security Advisory](https://forums.ivanti.com/s/article/Security-Bulletin-CVE-2025-0282)
- [ATT&CK: Exploit Public-Facing Application (T1190)](https://attack.mitre.org/techniques/T1190/)
- [CWE-121: Stack-based Buffer Overflow](https://cwe.mitre.org/data/definitions/121.html)
- [CWE-787: Out-of-bounds Write](https://cwe.mitre.org/data/definitions/787.html)
---
## Disclaimer
This repository is provided **for authorized security research and educational purposes only**. The authors are not responsible for any misuse of this code. Unauthorized exploitation of CVE-2025-0282 is illegal and unethical. Always obtain explicit written permission before testing any system.