Ivanti CSA shipped csrf-magic backdoor

CVE-2021-44529 looked like a code injection bug in Ivanti EPM Cloud Services Appliance. The patch told administrators to remove a block in /opt/landesk/broker/webroot/lib/csrf-magic.php beginning with // Obscure Tokens. That was the tell. The vulnerable code was not a normal parser mistake. It was a backdoor.

The injected PHP was small and blunt. It decoded obfuscated strings into str_replace, base64_decode, and create_function, then reached an eval path. A request with the right cookie shape could concatenate cookie values, base64-decode them, and execute the result. The marker response used c123.

Sonatype traced the likely origin to a counterfeit GitHub repository named like the csrf-magic project. The official csrf-magic source lived elsewhere, and the suspicious commit, f7f84f887a5f2e19926a2ad3c48614905629d60b, was not found in the official repo or its mirrors. The best public explanation is simple: a cloned project was poisoned and later consumed by Ivanti.

The record is therefore modeled as a proprietary distribution incident. The open-source project itself was not shown to be compromised. Ivanti's official appliance distributed the backdoored file, and patch 512 removed it. CISA later listed CVE-2021-44529 as known exploited.