CVE-2024-29822: Ivanti Endpoint Manager RCE Vulnerability

CVE-2024-29822 Overview

CVE-2024-29822 is a SQL Injection vulnerability affecting the Core server component of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior versions. This vulnerability allows an unauthenticated attacker positioned within the same network to execute arbitrary code on affected systems. The adjacent network attack vector means that while remote exploitation from the internet is not directly possible, any attacker with access to the local network segment can leverage this flaw without requiring any user interaction or authentication credentials.

Critical Impact

Unauthenticated attackers on the adjacent network can achieve arbitrary code execution through SQL injection, potentially compromising enterprise endpoint management infrastructure and all managed endpoints.

Affected Products

• Ivanti Endpoint Manager 2022 (base release)
• Ivanti Endpoint Manager 2022 SU1 through SU5
• Ivanti Endpoint Manager versions prior to 2022

Discovery Timeline

• May 31, 2024 - CVE-2024-29822 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-29822

Vulnerability Analysis

This vulnerability (CWE-89: SQL Injection) exists within the Core server component of Ivanti Endpoint Manager. SQL Injection vulnerabilities occur when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. In this case, the vulnerability allows attackers to manipulate database queries executed by the EPM Core server, ultimately achieving arbitrary code execution on the underlying system.

The attack requires adjacent network access, meaning the attacker must be positioned on the same network segment as the vulnerable Ivanti EPM server. However, once this positioning is achieved, no authentication is required and no user interaction is necessary to exploit the vulnerability. The successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands (SQL Injection). The Core server component fails to adequately validate or sanitize user-controlled input before incorporating it into SQL queries. This allows attackers to inject malicious SQL statements that are then executed by the database with the privileges of the application's database connection.

Attack Vector

The attack vector is adjacent network (AV:A), requiring the attacker to have access to the local network where the Ivanti EPM Core server resides. The exploitation flow involves:

1. The attacker gains access to the same network segment as the Ivanti EPM Core server
2. The attacker crafts malicious requests containing SQL injection payloads targeting the vulnerable endpoint
3. The Core server processes the malicious input without proper sanitization
4. The injected SQL commands are executed by the database
5. Through database functionality such as xp_cmdshell or similar mechanisms, the attacker achieves arbitrary code execution on the host system

The vulnerability is particularly dangerous in enterprise environments where endpoint management servers typically have extensive access to managed systems across the organization.

Detection Methods for CVE-2024-29822

Indicators of Compromise

• Unusual SQL error messages in Ivanti EPM Core server logs indicating injection attempts
• Unexpected database queries or stored procedure executions in database audit logs
• Anomalous network connections from the EPM Core server to external or unusual internal destinations
• Unauthorized processes spawned by the database service or EPM application processes

Detection Strategies

• Monitor Ivanti EPM Core server logs for SQL syntax errors or unusual query patterns that may indicate injection attempts
• Implement database activity monitoring to detect suspicious queries including UNION-based, time-based, or error-based SQL injection patterns
• Deploy network-based intrusion detection systems (IDS) with signatures for common SQL injection attack patterns targeting the EPM server
• Use endpoint detection and response (EDR) solutions to monitor for suspicious child processes spawned by EPM or database services

Monitoring Recommendations

• Enable verbose logging on the Ivanti EPM Core server and forward logs to a SIEM for analysis
• Configure database audit logging to capture all queries executed against the EPM database
• Monitor for unusual authentication failures or access patterns to the EPM management interface
• Implement network segmentation monitoring to detect lateral movement attempts from the EPM server

How to Mitigate CVE-2024-29822

Immediate Actions Required

• Apply the security patch referenced in the Ivanti Security Advisory - May 2024 immediately
• Isolate affected Ivanti EPM servers on a dedicated network segment with strict access controls
• Review firewall rules to limit network access to the EPM Core server to only authorized management systems
• Conduct a security review to determine if exploitation may have occurred prior to patching

Patch Information

Ivanti has released patches addressing this vulnerability. Administrators should consult the Ivanti Security Advisory - May 2024 for detailed patching instructions and download the appropriate security update for their EPM version. Organizations running Ivanti EPM 2022 SU5 or earlier must update to a patched version to remediate this vulnerability.

Workarounds

• Implement strict network segmentation to limit which systems can communicate with the EPM Core server on the adjacent network
• Deploy a web application firewall (WAF) or database firewall with SQL injection detection capabilities in front of the EPM server
• Disable or restrict access to database features that could enable code execution (such as xp_cmdshell on SQL Server) where operationally feasible
• Implement network access control (NAC) to prevent unauthorized devices from joining the network segment where EPM resides

# Network segmentation example - restrict access to EPM server
# Example iptables rules to limit access to Ivanti EPM Core server
iptables -A INPUT -s 10.0.1.0/24 -d 10.0.2.100 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -d 10.0.2.100 -p tcp --dport 443 -j DROP