CVE-2024-29826
📋 TL;DR
An unauthenticated SQL injection vulnerability in Ivanti EPM Core server allows attackers on the same network to execute arbitrary code. This affects Ivanti EPM 2022 SU5 and earlier versions, potentially leading to full system compromise.
💻 Affected Systems
- Ivanti Endpoint Manager (EPM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with administrative privileges, data exfiltration, lateral movement across the network, and persistent backdoor installation.
Likely Case
Unauthorized database access, credential theft, and execution of arbitrary commands on the EPM server.
If Mitigated
Limited impact with proper network segmentation, but still potential for database compromise within the segmented zone.
🎯 Exploit Status
SQL injection to RCE chain likely requires specific payload construction but follows common patterns
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022 SU6 or later
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-May-2024
Restart Required: Yes
Instructions:
1. Download latest EPM patch from Ivanti portal. 2. Backup current configuration. 3. Apply patch following Ivanti documentation. 4. Restart EPM services. 5. Verify successful update.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to EPM Core server to only necessary administrative systems
Web Application Firewall
allDeploy WAF with SQL injection rules in front of EPM server
🧯 If You Can't Patch
- Implement strict network ACLs to limit access to EPM server to trusted IPs only
- Monitor EPM server logs for SQL injection patterns and unusual database queries
🔍 How to Verify
Check if Vulnerable:
Check EPM version in administration console: if version is 2022 SU5 or earlier, system is vulnerableCheck Version:
Check via EPM web interface or review installation logsVerify Fix Applied:
Verify EPM version shows 2022 SU6 or later in administration console📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in EPM logs
- Multiple failed authentication attempts followed by complex queries
- Database error messages containing SQL syntax
Network Indicators:
- Unusual outbound connections from EPM server
- SQL payloads in HTTP requests to EPM endpoints
SIEM Query:
source="epm_logs" AND ("sql" OR "query" OR "syntax") AND ("error" OR "unusual" OR "malformed")