CVE-2019-12377
📋 TL;DR
This vulnerability in Ivanti LANDESK Management Suite allows attackers to upload arbitrary files to the server via the upl/async_upload.asp endpoint. This can lead to remote code execution, potentially giving attackers full control over affected systems. Organizations running vulnerable versions of LANDESK Management Suite are affected.
💻 Affected Systems
- Ivanti LANDESK Management Suite (LDMS, Endpoint Manager)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal sensitive data, deploy ransomware, or pivot to other systems in the network.
Likely Case
Attackers upload web shells or malicious scripts to gain persistent access, escalate privileges, and move laterally within the network.
If Mitigated
Limited impact with proper network segmentation, file upload validation, and monitoring in place.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available proof-of-concept code, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions after 10.0.1.168 Service Update 5
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-for-LANDESK-Management-Suite
Restart Required: Yes
Instructions:
1. Check current version. 2. Apply latest Ivanti security patches. 3. Restart LANDESK services. 4. Verify patch installation.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
windowsRestrict access to upl/async_upload.asp endpoint using web server configuration or firewall rules
# IIS: Add URL rewrite rule to block /upl/async_upload.asp
# Apache: Use mod_rewrite to deny access to the endpoint
Implement file upload validation
allAdd server-side validation for file uploads including file type checking and size limits
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LANDESK servers from critical systems
- Deploy web application firewall (WAF) with rules to detect and block file upload exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if upl/async_upload.asp endpoint exists and accepts file uploads without proper validation. Test with controlled file upload attempts.Check Version:
Check LANDESK console or installation directory for version informationVerify Fix Applied:
Verify the patch version is installed and test that the vulnerable endpoint no longer accepts arbitrary file uploads.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activity to upl/async_upload.asp
- Unexpected file creations in web directories
- Suspicious process executions from web server context
Network Indicators:
- POST requests to /upl/async_upload.asp with file uploads
- Unusual outbound connections from LANDESK server
SIEM Query:
source="LANDESK" AND (url="*/upl/async_upload.asp" OR file_upload="true")🔗 References
- https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-arbitrary-file-upload/
- https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/
- https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-arbitrary-file-upload/
- https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/
