CVE-2024-50326
📋 TL;DR
This SQL injection vulnerability in Ivanti Endpoint Manager allows authenticated administrators to execute arbitrary SQL commands, potentially leading to remote code execution. Organizations using Ivanti EPM versions before the November 2024 security updates are affected.
💻 Affected Systems
- Ivanti Endpoint Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative access to the underlying server, data exfiltration, and lateral movement within the network.
Likely Case
Database compromise leading to sensitive information disclosure, privilege escalation, and potential RCE on the EPM server.
If Mitigated
Limited impact if proper network segmentation, least privilege, and input validation controls are implemented.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit once identified, but this requires admin credentials
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024 November Security Update or 2022 SU6 November Security Update
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
Restart Required: Yes
Instructions:
1. Download the November 2024 security update from Ivanti portal. 2. Apply the update following Ivanti's documentation. 3. Restart the EPM server and services.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit administrative access to only trusted users and implement multi-factor authentication
Network Segmentation
allIsolate EPM server from critical systems and implement firewall rules
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application layer
- Deploy web application firewall with SQL injection rules
🔍 How to Verify
Check if Vulnerable:
Check EPM version in Ivanti console: Settings > AboutCheck Version:
Check Ivanti EPM console or review installed updates in Windows Control PanelVerify Fix Applied:
Verify version shows 2024 November Security Update or 2022 SU6 November Security Update applied📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin access
- Unexpected process execution on EPM server
Network Indicators:
- Unusual outbound connections from EPM server
- SQL query patterns in HTTP requests to EPM
SIEM Query:
source="epm_logs" AND (sql OR injection OR "exec sp_")