CVE-2024-32842: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2024-32842 Overview

CVE-2024-32842 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) that enables remote code execution. The flaw affects EPM versions before 2022 SU6 and the 2024 September update. Exploitation requires an authenticated attacker holding administrative privileges on the EPM console. Successful exploitation results in arbitrary code execution on the underlying host, giving attackers control over an enterprise management platform that reaches every managed endpoint.

Critical Impact
Authenticated administrators can pivot a SQL injection primitive into remote code execution on the Ivanti EPM server, exposing every endpoint the server manages.

Affected Products

Ivanti Endpoint Manager 2022 prior to Service Update 6 (SU6)
Ivanti Endpoint Manager 2022 SU1 through SU5
Ivanti Endpoint Manager 2024 prior to the September 2024 update

Discovery Timeline

2024-09-12 - CVE-2024-32842 published to the National Vulnerability Database (NVD)
2024-09-12 - Ivanti publishes the Ivanti Security Advisory September 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32842

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in an unspecified component of Ivanti Endpoint Manager. An attacker who is authenticated to the EPM management interface as an administrator can inject SQL statements into a backend query. Because EPM interacts with the database using a privileged service context, the injection primitive can be escalated to arbitrary command execution on the host running the EPM server.

Ivanti EPM manages software distribution, patching, and remote control for enterprise fleets. Code execution on the EPM server therefore represents a lateral movement bridge to every managed endpoint in the environment. The attack vector is network based and does not require user interaction, but the requirement for administrative credentials constrains opportunistic exploitation.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. User-controlled input reaches a query without adequate parameterization or escaping. Ivanti has not published the vulnerable endpoint, parameter, or query path. The September 2024 security update replaces the affected code path with input handling that prevents injection.

Attack Vector

An attacker must first obtain valid administrator credentials for the Ivanti EPM console. Credential theft, session hijacking, or abuse of a compromised administrator workstation all satisfy this prerequisite. The attacker then submits a crafted request to the vulnerable endpoint over the network. The injected SQL payload leverages database-level primitives, such as extended stored procedures or file write operations, to execute operating-system commands on the EPM host.

Refer to the Ivanti Security Advisory September 2024 for vendor guidance. No public proof-of-concept exploit is available at the time of writing.

Detection Methods for CVE-2024-32842

Indicators of Compromise

Unexpected child processes spawned by the EPM application or database service accounts, including cmd.exe, powershell.exe, or sqlservr.exe launching shells
SQL Server audit entries showing xp_cmdshell invocations or dynamic SQL execution from the EPM database context
Anomalous outbound network connections originating from the Ivanti EPM server to non-management infrastructure
New administrative accounts, scheduled tasks, or services created on the EPM host outside normal change windows

Detection Strategies

Enable SQL Server auditing on the EPM database and alert on xp_cmdshell, sp_OACreate, and other command-execution primitives
Baseline the process tree of the EPM application service and alert on deviations, particularly interpreter or scripting-host children
Review IIS or application logs for administrator requests containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in unexpected parameters

Monitoring Recommendations

Forward EPM server, IIS, and SQL Server logs into a centralized SIEM or data lake with retention aligned to incident response requirements
Monitor administrative logon activity to the EPM console and alert on logons from unusual source addresses or outside business hours
Track file system writes to web-accessible directories on the EPM server that could indicate webshell deployment

How to Mitigate CVE-2024-32842

Immediate Actions Required

Upgrade Ivanti Endpoint Manager 2022 to Service Update 6 (SU6) or later, and apply the September 2024 update for EPM 2024
Rotate credentials for all Ivanti EPM administrator accounts and review recent administrative activity for signs of misuse
Restrict network access to the EPM management interface to trusted administrative subnets or a jump host
Enforce multi-factor authentication (MFA) on all accounts with EPM administrative roles

Patch Information

Ivanti released fixes as part of the September 2024 security advisory for EPM 2022 and EPM 2024. Administrators should install EPM 2022 SU6 or the September 2024 update for EPM 2024, following the deployment guidance in the Ivanti Security Advisory September 2024.

Workarounds

No vendor-supplied workaround is documented; patching is the required remediation
Where patching cannot be scheduled immediately, isolate the EPM server behind network access controls and reduce the number of accounts granted the administrator role
Audit database service account privileges and disable xp_cmdshell on the EPM SQL Server instance if operationally feasible

bash

# Disable xp_cmdshell on the EPM SQL Server instance to reduce RCE impact
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;