CVE-2024-29825: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2024-29825 Overview

CVE-2024-29825 is a SQL injection vulnerability [CWE-89] in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior. An unauthenticated attacker on the same adjacent network can inject SQL statements that lead to arbitrary code execution on the EPM Core server. Ivanti disclosed the flaw in its May 2024 security advisory alongside a set of related EPM SQL injection issues. The vulnerability affects a management server that stores credentials and configuration data for every managed endpoint, giving an attacker who succeeds a direct path to broad enterprise compromise.

Critical Impact
An unauthenticated adjacent-network attacker can execute arbitrary code on the Ivanti EPM Core server, gaining control over the endpoint management infrastructure and, by extension, every device it manages.

Affected Products

Ivanti Endpoint Manager 2022 (base release)
Ivanti Endpoint Manager 2022 SU1 through SU5
Ivanti Endpoint Manager versions prior to 2022 SU5 with the May 2024 patch applied

Discovery Timeline

2024-05-31 - CVE-2024-29825 published to the National Vulnerability Database
2024-05 - Ivanti releases the Ivanti Security Advisory May 2024 with patched builds
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29825

Vulnerability Analysis

The vulnerability sits in the Ivanti EPM Core server, the central component that coordinates agent communication, software distribution, and patch management. An unspecified code path constructs SQL statements using attacker-controlled input without proper parameterization. Because the flaw is reachable pre-authentication, an attacker who can send network traffic to the Core server does not need any valid credentials.

The attack vector is adjacent (AV:A), meaning the attacker must be on the same logical network segment as the Core server, such as an internal corporate LAN or a shared VPN segment. Successful exploitation yields arbitrary code execution, typically under the service account that runs the Core server processes. That account generally has privileged access to the EPM database, agent management channels, and Windows service infrastructure.

EPSS data places the exploitation probability near the top of the distribution, indicating that public exploit activity or scanning for this class of Ivanti EPM flaws is active.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. Input received by the Core server is concatenated into a SQL query rather than bound as a parameter. When the resulting query is executed by the database engine, attacker-supplied syntax is interpreted as SQL, allowing stacked queries or database-level features that lead to command execution on the underlying host.

Attack Vector

An attacker with adjacent-network access sends a crafted request to a vulnerable service endpoint on the Core server. The malicious payload alters the SQL query structure and invokes database functionality that executes operating system commands, for example through xp_cmdshell or comparable mechanisms in the underlying database platform. No user interaction and no prior authentication are required.

Ivanti has not published the specific parameter or endpoint. See the Ivanti Security Advisory May 2024 for vendor-provided technical context.

Detection Methods for CVE-2024-29825

Indicators of Compromise

Unexpected child processes spawned by Ivanti EPM Core server services, particularly cmd.exe, powershell.exe, or scripting hosts descending from SQL Server or EPM service processes
New or modified Windows services, scheduled tasks, or local accounts on the EPM Core server host following anomalous inbound traffic
Outbound network connections from the Core server to unfamiliar external IP addresses or command-and-control infrastructure
SQL Server error log entries showing syntax errors, aborted transactions, or xp_cmdshell invocations that do not match normal EPM behavior

Detection Strategies

Hunt for process-lineage anomalies in which EPM Core or database processes launch shells, encoders, or download utilities such as certutil.exe or bitsadmin.exe
Inspect web and application logs on the Core server for requests containing SQL metacharacters, UNION SELECT, WAITFOR DELAY, or encoded variants targeting management endpoints
Correlate database audit logs with network flow data to spot query patterns that originate from unauthenticated sessions and precede command execution

Monitoring Recommendations

Enable and forward SQL Server audit logs and EPM Core application logs to a centralized analytics platform for longitudinal review
Baseline normal parent-child process relationships on EPM Core servers and alert on deviations, especially SQL-to-shell transitions
Monitor east-west traffic to the EPM Core server and alert on unexpected sources sending traffic to management ports

How to Mitigate CVE-2024-29825

Immediate Actions Required

Apply the Ivanti EPM 2022 SU6 (or later) update as directed in the Ivanti Security Advisory May 2024
Inventory all Ivanti EPM Core servers and confirm the installed build against the fixed version list in the advisory
Review authentication, service account activity, and scheduled tasks on the Core server for signs of prior exploitation before patching
Restrict network access to the EPM Core server to a defined set of management subnets and administrative jump hosts

Patch Information

Ivanti addressed CVE-2024-29825 in the May 2024 security release for Ivanti Endpoint Manager 2022. Administrators should upgrade to the fixed build listed in the Ivanti Security Advisory May 2024. No supported workaround replaces the patch. All prior 2022 service updates (base through SU5) remain vulnerable.

Workarounds

Segment the EPM Core server onto a dedicated management VLAN with strict ACLs allowing only required administrative sources
Block adjacent-network access to Core server management ports from user, guest, and third-party network segments until the patch is applied
Disable database features such as xp_cmdshell on the EPM database instance where operationally feasible to limit post-injection command execution
Increase logging verbosity on the Core server and database instance to improve visibility while patch deployment is in progress

bash

# Example: restrict inbound access to the EPM Core server via Windows Firewall
# Replace <MGMT_SUBNET> with your administrative subnet in CIDR notation
New-NetFirewallRule -DisplayName "EPM-Core-Restrict-Mgmt" `
  -Direction Inbound `
  -Action Allow `
  -RemoteAddress <MGMT_SUBNET> `
  -Protocol TCP `
  -LocalPort 443,8080,8443

New-NetFirewallRule -DisplayName "EPM-Core-Block-Other" `
  -Direction Inbound `
  -Action Block `
  -Protocol TCP `
  -LocalPort 443,8080,8443