CVE-2024-13162 Overview
CVE-2024-13162 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote authenticated attacker with administrative privileges to achieve remote code execution. The flaw affects Ivanti EPM 2024 releases before the January-2025 Security Update and EPM 2022 SU6 before the January-2025 Security Update. The advisory notes that this CVE addresses incomplete fixes from CVE-2024-32848. The weakness is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
An authenticated administrator can inject SQL statements that escalate to arbitrary code execution on the EPM server, compromising the endpoint management fabric used to control enrolled devices.
Affected Products
- Ivanti Endpoint Manager 2024 prior to the January-2025 Security Update
- Ivanti Endpoint Manager 2022 SU1 through SU5
- Ivanti Endpoint Manager 2022 SU6 prior to the January-2025 Security Update
Discovery Timeline
- 2025-01-14 - CVE-2024-13162 published to NVD alongside the Ivanti January 2025 EPM security advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13162
Vulnerability Analysis
The vulnerability resides in a database query path within Ivanti Endpoint Manager that accepts attacker-controlled input from an authenticated administrator without properly parameterizing or sanitizing the value before concatenating it into a SQL statement. Because EPM operates the SQL layer with elevated database privileges, injected statements can extend beyond data manipulation into command execution primitives. An attacker who successfully injects SQL can pivot from database compromise to arbitrary code execution on the EPM host, granting control over the management server itself.
This issue is a regression of CVE-2024-32848, meaning the earlier patch did not fully close the injection surface. Attackers with prior knowledge of that vulnerability can target the incomplete remediation path to reach the same code execution outcome.
Root Cause
The root cause is improper neutralization of special elements in a SQL command [CWE-89]. Input reaching the vulnerable query is concatenated into a statement rather than bound as a parameter, permitting statement structure manipulation. The prior remediation for CVE-2024-32848 did not address all affected code paths, leaving an exploitable variant.
Attack Vector
Exploitation requires network access to the EPM management interface and valid administrator credentials. The attacker submits crafted input to a vulnerable EPM endpoint that flows into the backend database query. Successful injection allows the attacker to execute SQL that leverages database features to run operating system commands on the underlying server. No user interaction is required beyond attacker-initiated requests. Refer to the Ivanti Security Advisory January 2025 for vendor-supplied technical context.
Detection Methods for CVE-2024-13162
Indicators of Compromise
- Unexpected xp_cmdshell or equivalent stored procedure activity originating from the EPM application service account
- New or modified administrative accounts in EPM followed by outbound connections from the EPM server host
- Anomalous child processes spawned by the SQL Server process (sqlservr.exe) such as cmd.exe, powershell.exe, or rundll32.exe
- HTTP requests to EPM administrative endpoints containing SQL meta-characters, UNION, SELECT, or stacked-query syntax in parameters
Detection Strategies
- Baseline normal query patterns from the EPM application account and alert on deviations that include DDL, xp_cmdshell invocation, or bulk system table access
- Correlate authenticated administrator sessions with subsequent process creation events on the EPM server to surface post-exploitation activity
- Inspect EPM web server logs for administrative POSTs containing SQL syntax fragments and encoded quote characters
Monitoring Recommendations
- Enable SQL Server audit logging for the EPM database and ship events to a centralized log platform for retention and correlation
- Monitor endpoint telemetry on the EPM server for process lineage where a database service spawns interactive shells or scripting hosts
- Track privileged EPM administrator logon sources and flag logons from unusual IP ranges or outside change windows
How to Mitigate CVE-2024-13162
Immediate Actions Required
- Apply the Ivanti EPM January-2025 Security Update for the 2024 branch, or the 2022 SU6 January-2025 Security Update for the 2022 branch, as documented in the vendor advisory
- Rotate credentials for EPM administrator accounts and the EPM database service account after patching
- Restrict network reachability of the EPM management console to trusted administrative subnets and VPN ranges
- Review EPM and SQL Server logs for signs of prior exploitation attempts targeting CVE-2024-32848 or CVE-2024-13162
Patch Information
Ivanti released fixes in the January 2025 security update cycle covering both the EPM 2024 and EPM 2022 SU6 branches. Administrators should consult the Ivanti Security Advisory January 2025 for the specific build numbers and installation guidance. Because this CVE addresses incomplete fixes from CVE-2024-32848, organizations that previously patched that earlier vulnerability must still install the January 2025 update.
Workarounds
- No vendor-supplied workaround eliminates the vulnerability; patching is the only complete remediation
- Reduce the attack surface by enforcing least-privilege for EPM administrator roles and requiring multi-factor authentication for all EPM logons
- Segment the EPM server so that only jump hosts and specific administrator workstations can reach the management interface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
