Hackers Inject DSLog Malware to 670 Devices Using Ivanti SSRF Flaw Exploit

Ivanti Connect Ranking was as soon as previously chanced on with yet every other SSRF vulnerability that could perhaps presumably moreover allow unauthenticated menace actors to entry unrestricted resources because of the a flaw within the SAML module. The vulnerability was as soon as assigned with CVE-2024-21893, and the severity was as soon as 8.2 (High).

Moreover, this vulnerability was as soon as previously reported to be exploited by menace actors within the wild genuine thru disclosure. Nonetheless, newest reports place that menace actors enjoy leveraged this vulnerability to put in a previously unknown and appealing “DSLog backdoor” on vulnerable devices.

Orange Cyberdefense detected 670 compromised resources that attackers injected backdoor the use of a SAML vulnerability. This equipped the attacker with power distant entry.

Hackers Exploiting Ivanti SSRF Flaw

In accordance to the reports, this vulnerability affects the embedded SAML module on Ivanti devices that menace actors exploit by injecting a backdoor with affirm injection. This backdoor was as soon as accessed and controlled with a standard “API Key” mechanism.

Preliminary search files from

Throughout the initial portion of the attack, menace actors ship an unauthenticated SAML authentication search files from that contains an encoded affirm with “RetrievalMethod URI.” The search files from was as soon as identified to be a URL-encoded search files from containing a base64 encoded affirm alongside the URI.

Decoding the search files from for URL and base64 offers the next line of affirm outdated by menace actors for exploitation.

This affirm gathers inner reconnaissance files and stores it into a file named “index2.txt” the use of the ‘echo’ affirm line tool. The encoded strings are moreover decoded the use of the base64 decode utility and bash affirm interpreter.

Backdoor Installation

Once the above affirm is carried out efficiently, the menace actors then try and install the backdoor on the vulnerable tool the use of the same strategy of URL and Base64 encoding of instructions. The search files from is as follows:

This backdoor affirm is carried out on the compromised tool, and the backdoor is inserted into an existing Perl file named “DSLog.pm”. The DSLog is a module to blame for logging authenticated web requests and web requests and arrangement logs on the tool.

Orange Cyber Protection offers a complete breakdown of the backdoor, affirm execution, methodologies, and assorted technical facts for these with a tough technical background.

Indicators of Compromise

Host-based IoC

Community-based IoC