CVE-2024-29827: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2024-29827 Overview

CVE-2024-29827 is a SQL injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior versions. An unauthenticated attacker on the same network can inject malicious SQL statements to execute arbitrary code on the Core server. The flaw is tracked as [CWE-89] and affects the management backbone used to deploy software, patches, and configuration across enterprise endpoints. Ivanti disclosed the issue in its May 2024 security advisory. Successful exploitation grants attackers full control over the EPM Core server, which manages every endpoint enrolled in the platform.

Critical Impact
An adjacent, unauthenticated attacker can execute arbitrary code on the Ivanti EPM Core server, compromising every managed endpoint downstream.

Affected Products

Ivanti Endpoint Manager 2022 (base release)
Ivanti Endpoint Manager 2022 SU1 through SU4
Ivanti Endpoint Manager 2022 SU5 and prior

Discovery Timeline

2024-05-31 - CVE-2024-29827 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29827

Vulnerability Analysis

The vulnerability resides in the Core server component of Ivanti Endpoint Manager. Ivanti has not published the specific injectable endpoint or parameter in its public advisory. The flaw allows an unauthenticated attacker on an adjacent network to send crafted input that the Core server concatenates into a SQL query. The database engine then interprets attacker-supplied strings as SQL commands, breaking the boundary between data and code.

Because the Core server executes queries against a backend database with elevated privileges, the injection escalates from data manipulation to arbitrary code execution. Attackers can use SQL features such as xp_cmdshell on Microsoft SQL Server or stored procedure abuse to run operating system commands. The EPS score of 71.685% places this vulnerability in the top percentile of exploitation likelihood.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. Input received by a Core server interface reaches a database query without parameterization or adequate sanitization. Ivanti classified this as an unspecified SQL injection, meaning the exact code path is withheld from the public advisory.

Attack Vector

The attack vector is adjacent network access, requiring the attacker to reside on the same broadcast or logical network segment as the EPM Core server. No authentication or user interaction is needed. An attacker who gains a foothold on any workstation in the environment can pivot to the EPM Core server and issue crafted SQL injection payloads.

Exploitation of Ivanti EPM Core translates into control over agent deployment, script execution, and patch distribution across every managed endpoint. See the Ivanti Security Advisory May 2024 for advisory-level context. No public proof-of-concept code is currently available in Exploit-DB or CISA KEV.

Detection Methods for CVE-2024-29827

Indicators of Compromise

Unexpected SQL error messages or long-running queries in the EPM database logs originating from Core server processes.
New or modified stored procedures on the EPM database, especially those referencing xp_cmdshell, sp_OACreate, or command execution primitives.
Spawning of cmd.exe, powershell.exe, or sqlservr.exe child processes from the Core server service account outside normal maintenance windows.
Outbound network connections from the EPM Core server to unfamiliar hosts on the adjacent subnet.

Detection Strategies

Baseline the parent-child process tree of the EPM Core service, then alert on deviations such as shell processes spawned by SQL Server or Core server binaries.
Enable SQL Server audit logging for xp_cmdshell invocation and privileged stored procedure creation on the EPM database instance.
Monitor HTTP and RPC traffic to the Core server for payloads containing SQL metacharacters, UNION SELECT, or stacked-query patterns.

Monitoring Recommendations

Forward EPM Core server, IIS, and SQL Server logs to a centralized SIEM for correlation with endpoint telemetry.
Continuously monitor for lateral movement from EPM-managed workstations toward the Core server on management ports.
Track service account activity for the EPM database and Core server for anomalous logon times or source hosts.

How to Mitigate CVE-2024-29827

Immediate Actions Required

Apply the patch referenced in the Ivanti Security Advisory May 2024 to all EPM 2022 SU5 and prior Core servers.
Restrict network access to the EPM Core server to a dedicated management VLAN and a small set of administrative hosts.
Audit the EPM database for unauthorized stored procedures, new logins, and unexpected xp_cmdshell configuration changes.
Rotate credentials used by the EPM Core service account and the backing SQL Server instance.

Patch Information

Ivanti released fixes for CVE-2024-29827 as part of the May 2024 security advisory covering Endpoint Manager 2022 SU5 and prior. Administrators should upgrade to the fixed release identified in the advisory. Consult the Ivanti Security Advisory May 2024 for the exact build numbers and download instructions.

Workarounds

Segment the EPM Core server behind a firewall or ACL that blocks direct traffic from general user subnets.
Disable xp_cmdshell on the SQL Server hosting the EPM database if operational requirements permit.
Enforce the principle of least privilege on the SQL account used by the Core server, limiting it to the tables and procedures it strictly needs.

bash

# Configuration example: disable xp_cmdshell on the EPM SQL Server instance
sqlcmd -S <EPM_SQL_SERVER> -E -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"