CVE-2024-29823: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2024-29823 Overview

CVE-2024-29823 is a SQL Injection vulnerability [CWE-89] in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior. An unauthenticated attacker on the same network can inject crafted SQL statements to execute arbitrary code on the Core server. The flaw affects the on-premises component that manages endpoint inventory, software distribution, and patching across enterprise environments. Successful exploitation compromises confidentiality, integrity, and availability of the management server and the endpoints it controls. The vulnerability carries an EPSS probability of 99.86% (99.961 percentile), indicating a very high likelihood of exploitation activity.

Critical Impact
Unauthenticated adjacent-network attackers can run arbitrary code on Ivanti EPM Core servers, providing a foothold to pivot into managed endpoints across the enterprise.

Affected Products

Ivanti Endpoint Manager 2022 (base release)
Ivanti Endpoint Manager 2022 SU1 through SU4
Ivanti Endpoint Manager 2022 SU5

Discovery Timeline

2024-05-31 - CVE-2024-29823 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29823

Vulnerability Analysis

The Core server of Ivanti EPM handles device management operations through database-backed queries. One of these code paths concatenates attacker-controlled input into a SQL statement without proper parameterization or sanitization. An adjacent-network attacker who can reach the Core server's exposed service submits a crafted request that alters the intended query structure.

Because the underlying database context in EPM permits execution of extended stored procedures such as xp_cmdshell on Microsoft SQL Server, SQL injection converts directly into command execution on the host. This turns a data-layer flaw into full server compromise without requiring credentials.

EPM Core is a privileged management plane. Code execution on the Core server exposes agent communication channels, software distribution pipelines, and stored administrative secrets, enabling downstream compromise of every endpoint enrolled with the server.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input received over the network is passed into a dynamically built query without prepared statements, parameter binding, or input validation.

Attack Vector

Exploitation requires network adjacency to the Core server, no authentication, and no user interaction. The attacker sends a crafted request containing SQL metacharacters, which the Core server incorporates into a backend query. The manipulated query executes with the privileges of the EPM database service, from which an attacker can reach operating-system command execution.

A public technical write-up and proof-of-concept parameters are not linked in the NVD record for this CVE. Refer to the Ivanti Security Advisory May 2024 for vendor-confirmed details.

Detection Methods for CVE-2024-29823

Indicators of Compromise

Unexpected child processes spawned by the SQL Server service account (sqlservr.exe spawning cmd.exe, powershell.exe, or certutil.exe) on the EPM Core host.
New or modified files under EPM installation directories written by the database service account.
Outbound network connections from the EPM Core server to unknown external hosts shortly after inbound requests to management ports.
Anomalous SQL query patterns in database logs containing stacked statements, xp_cmdshell invocations, or EXEC calls.

Detection Strategies

Enable SQL Server auditing on the EPM database and alert on execution of xp_cmdshell, sp_OACreate, or other command-surface stored procedures.
Inspect web and application logs on the Core server for requests containing SQL metacharacters (', --, ;, UNION, WAITFOR DELAY) against management endpoints.
Correlate process-creation telemetry on the Core server with inbound network events to identify request-driven command execution.

Monitoring Recommendations

Baseline normal process trees for sqlservr.exe and LANDESK service accounts; alert on deviations.
Monitor for privilege changes, new local accounts, and scheduled task creation on the EPM Core server.
Forward EPM Core and SQL Server logs to a central analytics platform for retention and correlation.

How to Mitigate CVE-2024-29823

Immediate Actions Required

Apply the Ivanti EPM 2022 SU6 hotfix or later as documented in the vendor advisory.
Restrict network access to the EPM Core server so only administrative subnets can reach management ports.
Review SQL Server logs and Core server process history for signs of prior exploitation before and after patching.

Patch Information

Ivanti published fixes in the Ivanti Security Advisory May 2024. Administrators running Ivanti EPM 2022 SU5 or earlier must upgrade to the patched release identified in that advisory. No supported workaround replaces the patch.

Workarounds

Place the EPM Core server behind a firewall or jump host that limits inbound access to trusted administrative sources.
Disable xp_cmdshell and other unnecessary extended stored procedures on the EPM database to reduce SQL-to-command escalation paths.
Rotate credentials and service-account secrets stored on the Core server after patching if compromise cannot be ruled out.

bash

# Configuration example: disable xp_cmdshell on the EPM SQL Server instance
sqlcmd -S <EPM_SQL_HOST> -E -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"