CVE-2024-10630
📋 TL;DR
A race condition vulnerability in Ivanti Application Control Engine allows authenticated local attackers to bypass application blocking controls. This affects organizations using Ivanti Application Control Engine versions before 10.14.4.0 to restrict application execution on endpoints.
💻 Affected Systems
- Ivanti Application Control Engine
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could execute arbitrary malicious applications that should be blocked by policy, potentially leading to privilege escalation, data exfiltration, or lateral movement within the network.
Likely Case
Local users with standard privileges could bypass application restrictions to run unauthorized software, violating security policies and potentially introducing malware.
If Mitigated
With proper network segmentation and endpoint monitoring, the impact would be limited to the local system with minimal lateral movement capability.
🎯 Exploit Status
Exploitation requires timing attacks (race condition) and local authenticated access. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.14.4.0
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Application-Control-Engine-CVE-2024-10630
Restart Required: No
Instructions:
1. Download Ivanti Application Control Engine version 10.14.4.0 or later from the Ivanti portal. 2. Deploy the update through your standard patch management process. 3. Verify the update was successful by checking the version number.
🔧 Temporary Workarounds
Restrict Local User Privileges
allLimit local user privileges to reduce the attack surface for authenticated exploitation.
🧯 If You Can't Patch
- Implement strict network segmentation to limit lateral movement from potentially compromised endpoints.
- Enhance endpoint monitoring for unusual application execution patterns that might indicate bypass attempts.
🔍 How to Verify
Check if Vulnerable:
Check the Ivanti Application Control Engine version in the management console or via 'wmic product get name,version' command on Windows endpoints.Check Version:
wmic product where "name like 'Ivanti Application Control Engine%'" get versionVerify Fix Applied:
Confirm the version is 10.14.4.0 or later in the management console or via version check commands.📡 Detection & Monitoring
Log Indicators:
- Unusual application execution events in Ivanti Application Control logs
- Multiple rapid application execution attempts that might indicate race condition exploitation
Network Indicators:
- Unusual outbound connections from endpoints that should have restricted application access
SIEM Query:
source="ivanti_ace" AND (event_type="application_execution" AND result="bypassed")