{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2024-29824/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:endpoint_manager:2022:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2024-29824"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HORIZON3AI-CVE-2024-29824\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["ivanti","epm","sql-injection","remote-code-execution","cve-2024-29824"],"_cs_type":"advisory","_cs_vendors":["Ivanti"],"content_html":"\u003cp\u003eCVE-2024-29824 is a critical SQL injection vulnerability affecting Ivanti Endpoint Manager (EPM). The vulnerability, which has a CVSS score of 9.8, resides in the \u003ccode\u003eRecordGoodApp\u003c/code\u003e function within the \u003ccode\u003ePatchBiz.dll\u003c/code\u003e file. Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the target system. Publicly available exploit code exists, increasing the likelihood of widespread exploitation. The vulnerability can be exploited by crafting a malicious HTTP POST request targeting the \u003ccode\u003e/WSStatusEvents/EventHandler.asmx\u003c/code\u003e endpoint, specifically manipulating the \u003ccode\u003egoodApp.md5\u003c/code\u003e parameter. This vulnerability poses a significant risk to organizations utilizing vulnerable versions of Ivanti EPM.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Ivanti EPM server exposed to the network.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003e/WSStatusEvents/EventHandler.asmx\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted POST request includes a SQL injection payload within the \u003ccode\u003egoodApp.md5\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003eRecordGoodApp\u003c/code\u003e function in \u003ccode\u003ePatchBiz.dll\u003c/code\u003e processes the malicious SQL query without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe injected SQL code executes arbitrary commands on the underlying database server, potentially using \u003ccode\u003exp_cmdshell\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker gains remote code execution on the Ivanti EPM server, allowing them to install malware or exfiltrate data.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes persistence mechanisms for continued access.\u003c/li\u003e\n\u003cli\u003eThe attacker pivots to other systems within the network, escalating privileges and achieving further objectives.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2024-29824 allows for complete compromise of the Ivanti EPM server. This can lead to data breaches, system outages, and the deployment of ransomware. Given the critical role of EPM in managing endpoints, a successful attack can cascade to compromise numerous other systems within the organization. The vulnerability's high CVSS score (9.8) reflects the severity of the potential impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eIvanti EPM CVE-2024-29824 Exploitation Attempt\u003c/code\u003e to detect suspicious HTTP requests to the \u003ccode\u003e/WSStatusEvents/EventHandler.asmx\u003c/code\u003e endpoint (logsource: webserver).\u003c/li\u003e\n\u003cli\u003eEnable TLS inspection on web traffic to inspect the content of HTTP POST requests and detect malicious SQL payloads (logsource: proxy).\u003c/li\u003e\n\u003cli\u003eReview and restrict access to the \u003ccode\u003e/WSStatusEvents/EventHandler.asmx\u003c/code\u003e endpoint to only authorized users or systems (firewall logs).\u003c/li\u003e\n\u003cli\u003ePrioritize patching Ivanti EPM to the latest version to remediate CVE-2024-29824, as documented in Ivanti's security advisory (reference: CVE-2024-29824).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T08:46:44Z","date_published":"2024-10-26T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-10-ivanti-epm-sqli/","summary":"Exploitation of CVE-2024-29824, a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), allows remote code execution via a crafted HTTP POST request to the `/WSStatusEvents/EventHandler.asmx` endpoint.","title":"Ivanti EPM SQL Injection Vulnerability Exploitation (CVE-2024-29824)","url":"https://feed.craftedsignal.io/briefs/2024-10-ivanti-epm-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2024-29824","version":"https://jsonfeed.org/version/1.1"}