MITRE is not a soft target. It runs the ATT&CK framework, it advises the organizations that write the standards, and its own summary of the incident was blunt: no organization is immune, "not even one that strives to maintain the highest cybersecurity possible."
In January 2024, MITRE found that state-backed attackers had been inside a research network since the previous month. The way in was a pair of zero-days in an Ivanti Connect Secure VPN appliance.
What actually happened
Two vulnerabilities were chained:
| CVE | What it does |
|---|---|
| CVE-2023-46805 | Authentication bypass |
| CVE-2024-21887 | Command injection |
An authentication bypass followed by command injection is about as bad as an edge appliance gets. The first removes the need for a credential. The second turns the appliance into a foothold. Neither requires the attacker to know anything about the organization behind it.
MITRE had multi-factor authentication. The attackers got past it with session hijacking, then moved laterally using a hijacked administrator account in the VMware infrastructure.
More than 2,100 Ivanti appliances were compromised worldwide in the same campaign. That number is the tell: this was not a targeted operation against MITRE that happened to use Ivanti. It was a campaign against everything running Ivanti that would answer.
The gap: an appliance you cannot patch yet is an appliance that still answers
The honest defensive answer to a zero-day is patching, and patching is not instant. The vulnerabilities were being exploited in the wild from early December 2023. CISA issued an emergency directive on 19 January 2024. Between those dates, every organization running the appliance had a component on the internet with a known, unpatched authentication bypass in it.
During the window between disclosure and deployment, the vulnerability is not the variable you control. Reachability is.
Consider what an authentication bypass actually needs to work. It needs the appliance to accept a connection and process a request. That is it. Every control MITRE had behind the appliance was irrelevant, because the exploit happened before any of them engaged.
MFA is worth noting separately, because it was present and it did not help. Session hijacking works on a session, and a session existed because the attackers had already got past the front door by a route that never asked for a credential. A control that authenticates people cannot help when the attacker never attempted authentication.
What would have had to be true
The exploit chain required the appliance to answer the attacker's network.
If the appliance had accepted connections only from the networks MITRE's own attested devices were connecting from, the scan that found it would have got nothing back. The exploit would have had no target to be sent to. The appliance would still have been vulnerable, and the vulnerability would still have needed patching, but a vulnerability that cannot be reached is a maintenance task rather than an incident.
That is a distinction worth sitting with, because it is the difference between a bad week for the patching team and six weeks of state actors in a research network.
Where Veribound would have fitted
Veribound does not patch anything, does not sit in the traffic path, and does not replace the VPN. It informs the edge that is already there.
An agent on each staff device keeps confirming it is still the one the organization trusted. What reaches the customer's firewall is a trusted origin: the network that device is connecting from, in practice its public address. Those arrive as address-group updates against policy the organization already has, which is the difference between a maintenance task and an incident.
In this incident:
- The scanning campaign that found 2,100 appliances does not find this one, because it does not answer an unrecognized network.
- The authentication bypass is still a real vulnerability and still needs the patch. It is not reachable by anyone who is not already trusted.
- Session hijacking never becomes relevant, because there is no session to hijack.
What it would not have changed: nothing about this removes the need to patch, and nothing about it helps if an attacker is already operating from a device and network you trust. This is a control against strangers, positioned before the ones that handle people you have let in.
The appliance industry has spent several years learning that the device protecting the perimeter is itself on the perimeter. MITRE's experience is the clearest statement of that available, from an organization that had every reason to be ready for it.
Source: MITRE says state hackers breached its network via Ivanti zero-days, BleepingComputer, 19 April 2024.