CVE-2024-13161
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to perform absolute path traversal attacks on Ivanti Endpoint Manager (EPM) systems, potentially leaking sensitive information like credentials and configuration files. It affects all Ivanti EPM deployments before the January 2025 security updates.
💻 Affected Systems
- Ivanti Endpoint Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through credential theft leading to domain takeover, lateral movement, and data exfiltration.
Likely Case
Sensitive information disclosure including administrative credentials, configuration files, and system information that enables further attacks.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to EPM interfaces.
🎯 Exploit Status
Exploitation is trivial with public proof-of-concept code available. CISA confirms active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EPM 2024 January 2025 Security Update, EPM 2022 SU6 January 2025 Security Update
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
Restart Required: Yes
Instructions:
1. Download the security update from Ivanti portal. 2. Apply the update to all EPM servers. 3. Restart the EPM services. 4. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to EPM servers to only trusted administrative networks
Firewall Rules
allBlock external access to EPM web interfaces and management ports
🧯 If You Can't Patch
- Immediately isolate EPM servers from internet and untrusted networks
- Implement strict network access controls and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check EPM version against affected versions. Test with path traversal payloads to sensitive files.Check Version:
Check EPM console or server properties for version informationVerify Fix Applied:
Verify EPM version shows the January 2025 security update applied. Test that path traversal attempts now fail.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in EPM logs
- Multiple failed path traversal attempts
- Access to sensitive configuration files
Network Indicators:
- HTTP requests with ../ patterns to EPM servers
- Unusual outbound connections from EPM servers
SIEM Query:
source="epm_logs" AND ("..\\" OR "../" OR "absolute path")🔗 References
- https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13161
- https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
