CVE-2024-13158: Ivanti Endpoint Manager RCE Vulnerability

CVE-2024-13158 Overview

CVE-2024-13158 is a path traversal vulnerability [CWE-22] in Ivanti Endpoint Manager (EPM) caused by an unbounded resource search path. A remote authenticated attacker with administrative privileges can leverage the flaw to achieve remote code execution on affected EPM servers. The issue affects Ivanti EPM versions prior to the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. Ivanti disclosed the vulnerability in its January 2025 security advisory. The CVSS 3.1 base score is 7.2, reflecting network-based exploitation with confidentiality, integrity, and availability impact.

Critical Impact
An authenticated administrator can execute arbitrary code on the Ivanti EPM server, expanding compromise of the management infrastructure and any endpoints it controls.

Affected Products

Ivanti Endpoint Manager 2024 (before the January-2025 Security Update)
Ivanti Endpoint Manager 2022 SU1 through SU5
Ivanti Endpoint Manager 2022 SU6 (before the January-2025 Security Update)

Discovery Timeline

2025-01-14 - CVE-2024-13158 published to NVD
2025-01-14 - Ivanti releases the January 2025 EPM Security Advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13158

Vulnerability Analysis

The vulnerability originates in how Ivanti EPM resolves resource paths used by server-side components. Because the search path is unbounded, EPM will locate and load resources from directories outside the intended trust boundary. An authenticated administrator can plant or reference a malicious resource that the EPM process then loads, resulting in code execution in the context of the EPM service.

Successful exploitation grants control over the management server, which centrally administers managed endpoints. From this position an attacker can distribute payloads, retrieve secrets, or pivot deeper into the environment. The EPSS score is 3.465% (87th percentile), indicating a moderate probability of exploitation activity relative to other CVEs.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Ivanti EPM does not sufficiently constrain the directories searched when resolving resources, permitting attacker-supplied paths or files to influence which binary or module gets loaded and executed by the service.

Attack Vector

Exploitation requires network access to the EPM management interface and valid administrator credentials. An attacker who has already compromised or been granted an EPM admin account submits a crafted request or configures a resource path that causes EPM to load an attacker-controlled artifact. No user interaction is required beyond the attacker's own actions.

Because the flaw requires administrative privileges, it is most impactful as a post-compromise capability. Attackers commonly use such flaws to convert stolen credentials or session tokens into durable code execution and persistence on the management tier.

Detection Methods for CVE-2024-13158

Indicators of Compromise

Unexpected files or DLLs written to directories referenced by the EPM service or its plugins.
New or modified processes spawned by the EPM service account performing non-standard actions such as script execution, credential access, or lateral movement.
Administrator logins to EPM from unusual source IPs, geolocations, or outside change windows.

Detection Strategies

Baseline the file inventory of EPM installation and resource directories and alert on additions or modifications of executable content.
Monitor EPM audit logs for administrative actions that alter resource paths, plugin configuration, or upload files to server-side locations.
Correlate EPM service process child-process creation with endpoint telemetry to identify anomalous execution chains.

Monitoring Recommendations

Forward EPM application, IIS, and Windows event logs to a centralized SIEM or data lake for retention and correlation.
Enable command-line and module load auditing on the EPM server so DLL or resource loads from unexpected paths are captured.
Alert on any successful authentication to the EPM console followed by service restarts or configuration changes within a short time window.

How to Mitigate CVE-2024-13158

Immediate Actions Required

Apply the Ivanti EPM 2024 January-2025 Security Update or the 2022 SU6 January-2025 Security Update as soon as possible.
Inventory all Ivanti EPM servers and confirm patch level against the fixed builds listed in the Ivanti advisory.
Rotate credentials for EPM administrator accounts and review recent admin activity for signs of unauthorized use.

Patch Information

Ivanti addressed the vulnerability in the EPM 2024 January-2025 Security Update and the EPM 2022 SU6 January-2025 Security Update. Refer to the Ivanti Security Advisory EPM January 2025 for the exact fixed versions, download links, and installation guidance.

Workarounds

Restrict network access to the EPM management console to trusted administrative networks using firewall or VPN controls.
Enforce multi-factor authentication and least privilege on all EPM administrator accounts to reduce the pool of principals able to trigger the flaw.
Monitor and restrict write access to EPM server filesystem paths so non-administrative users cannot stage resources referenced by the service.

bash

# Example: restrict inbound access to the EPM console to a management subnet
New-NetFirewallRule -DisplayName "Restrict EPM Console" `
  -Direction Inbound -Action Allow -Protocol TCP `
  -LocalPort 443 -RemoteAddress 10.10.50.0/24

New-NetFirewallRule -DisplayName "Block EPM Console Default" `
  -Direction Inbound -Action Block -Protocol TCP `
  -LocalPort 443