Attack Chain

1. The attacker identifies a vulnerable Ivanti EPM server exposed to the network.
2. The attacker crafts a malicious HTTP POST request targeting the /WSStatusEvents/EventHandler.asmx endpoint.
3. The crafted POST request includes a SQL injection payload within the goodApp.md5 parameter.
4. The vulnerable RecordGoodApp function in PatchBiz.dll processes the malicious SQL query without proper sanitization.
5. The injected SQL code executes arbitrary commands on the underlying database server, potentially using xp_cmdshell.
6. The attacker gains remote code execution on the Ivanti EPM server, allowing them to install malware or exfiltrate data.
7. The attacker establishes persistence mechanisms for continued access.
8. The attacker pivots to other systems within the network, escalating privileges and achieving further objectives.

Impact

Successful exploitation of CVE-2024-29824 allows for complete compromise of the Ivanti EPM server. This can lead to data breaches, system outages, and the deployment of ransomware. Given the critical role of EPM in managing endpoints, a successful attack can cascade to compromise numerous other systems within the organization. The vulnerability's high CVSS score (9.8) reflects the severity of the potential impact.

Recommendation

• Deploy the Sigma rule Ivanti EPM CVE-2024-29824 Exploitation Attempt to detect suspicious HTTP requests to the /WSStatusEvents/EventHandler.asmx endpoint (logsource: webserver).
• Enable TLS inspection on web traffic to inspect the content of HTTP POST requests and detect malicious SQL payloads (logsource: proxy).
• Review and restrict access to the /WSStatusEvents/EventHandler.asmx endpoint to only authorized users or systems (firewall logs).
• Prioritize patching Ivanti EPM to the latest version to remediate CVE-2024-29824, as documented in Ivanti's security advisory (reference: CVE-2024-29824).