Ivanti EPM SQL Injection Vulnerability Exploitation (CVE-2024-29824)

CVE-2024-29824 is a critical SQL injection vulnerability affecting Ivanti Endpoint Manager (EPM). The vulnerability, which has a CVSS score of 9.8, resides in the RecordGoodApp function within the PatchBiz.dll file. Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the target system. Publicly available exploit code exists, increasing the likelihood of widespread exploitation. The vulnerability can be exploited by crafting a malicious HTTP POST request targeting the /WSStatusEvents/EventHandler.asmx endpoint, specifically manipulating the goodApp.md5 parameter. This vulnerability poses a significant risk to organizations utilizing vulnerable versions of Ivanti EPM.

Attack Chain

1. The attacker identifies a vulnerable Ivanti EPM server exposed to the network.
2. The attacker crafts a malicious HTTP POST request targeting the /WSStatusEvents/EventHandler.asmx endpoint.
3. The crafted POST request includes a SQL injection payload within the goodApp.md5 parameter.
4. The vulnerable RecordGoodApp function in PatchBiz.dll processes the malicious SQL query without proper sanitization.
5. The injected SQL code executes arbitrary commands on the underlying database server, potentially using xp_cmdshell.
6. The attacker gains remote code execution on the Ivanti EPM server, allowing them to install malware or exfiltrate data.
7. The attacker establishes persistence mechanisms for continued access.
8. The attacker pivots to other systems within the network, escalating privileges and achieving further objectives.

Impact

Successful exploitation of CVE-2024-29824 allows for complete compromise of the Ivanti EPM server. This can lead to data breaches, system outages, and the deployment of ransomware. Given the critical role of EPM in managing endpoints, a successful attack can cascade to compromise numerous other systems within the organization. The vulnerability's high CVSS score (9.8) reflects the severity of the potential impact.

Recommendation

• Deploy the Sigma rule Ivanti EPM CVE-2024-29824 Exploitation Attempt to detect suspicious HTTP requests to the /WSStatusEvents/EventHandler.asmx endpoint (logsource: webserver).
• Enable TLS inspection on web traffic to inspect the content of HTTP POST requests and detect malicious SQL payloads (logsource: proxy).
• Review and restrict access to the /WSStatusEvents/EventHandler.asmx endpoint to only authorized users or systems (firewall logs).
• Prioritize patching Ivanti EPM to the latest version to remediate CVE-2024-29824, as documented in Ivanti's security advisory (reference: CVE-2024-29824).