CVE-2024-34787 Overview
CVE-2024-34787 is a path traversal vulnerability [CWE-22] in Ivanti Endpoint Manager (EPM). The flaw allows a local unauthenticated attacker to achieve code execution when a user interacts with a crafted input. Ivanti addressed the issue in the 2024 November Security Update and the 2022 SU6 November Security Update.
The vulnerability affects Ivanti EPM 2024 and Ivanti EPM 2022 through SU5. Ivanti published a security advisory on November 12, 2024, and the CVE was released to the National Vulnerability Database (NVD) the following day.
Critical Impact
Successful exploitation grants an attacker code execution on the affected endpoint manager host, with high impact to confidentiality, integrity, and availability. EPSS data places this CVE in the 96.89th percentile for likelihood of exploitation.
Affected Products
- Ivanti Endpoint Manager 2024 (prior to the November 2024 Security Update)
- Ivanti Endpoint Manager 2022 SU1 through SU5
- Ivanti Endpoint Manager 2022 (base release)
Discovery Timeline
- 2024-11-13 - CVE-2024-34787 published to NVD
- 2024-11-13 - Ivanti releases security advisory and patches for EPM 2024 and EPM 2022 SU6
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34787
Vulnerability Analysis
CVE-2024-34787 is a path traversal weakness in Ivanti Endpoint Manager. Path traversal issues arise when an application resolves user-supplied file or directory names without sufficient validation. An attacker who controls the input can escape the intended directory with sequences such as ..\ or absolute path fragments.
In this case, the traversal primitive leads directly to code execution on the host running EPM. The advisory indicates the attack is local and requires user interaction, meaning the attacker must convince a legitimate user to open or process a crafted file or artifact. Once processed, the traversal writes or references an attacker-chosen path, allowing malicious code to run in the context of the vulnerable component.
Ivanti Endpoint Manager is a systems management platform used to distribute software, patches, and configurations to enterprise endpoints. Code execution against this component can pivot into broad control over managed endpoints.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected code path in EPM does not canonicalize or validate user-controlled path input before opening, writing, or referencing a file resource. Ivanti has not published detailed code-level information about the affected function.
Attack Vector
Exploitation requires local access and user interaction. An attacker delivers a crafted file, package, or input to a user with access to the EPM component. When the user processes the artifact, the traversal payload places or references content at an attacker-controlled location, triggering code execution with the privileges of the receiving process.
No verified public proof-of-concept code is available at the time of writing. See the Ivanti Security Advisory EPM November 2024 for vendor guidance.
Detection Methods for CVE-2024-34787
Indicators of Compromise
- Files written by EPM processes to paths outside expected working directories, especially paths containing ..\ or unexpected drive roots
- New or modified executables, scripts, or DLLs in EPM installation or agent directories that do not match a known patch or deployment
- Unexpected child processes spawned by EPM services shortly after a user opens a delivered file or package
Detection Strategies
- Compare EPM binary and configuration file hashes against a known-good baseline from a patched installation
- Alert on file-creation events by EPM service accounts targeting directories outside the standard EPM data paths
- Correlate user file-open events with subsequent process creation from EPM service contexts to surface user-interaction-based exploitation
Monitoring Recommendations
- Enable command-line and process-creation auditing on EPM servers and forward the events to a centralized analytics platform
- Monitor Ivanti EPM logs for errors related to file path resolution, package extraction, or import operations
- Track outbound network connections from EPM hosts for beacons or unusual destinations following suspected exploitation
How to Mitigate CVE-2024-34787
Immediate Actions Required
- Apply the Ivanti EPM 2024 November Security Update or the EPM 2022 SU6 November Security Update to all affected servers
- Inventory EPM installations and confirm each host is on a fixed build; prioritize internet-adjacent or high-privilege management servers
- Restrict interactive access to EPM servers to a minimal set of administrative users to reduce the attack surface for user-interaction exploitation
Patch Information
Ivanti released fixes in the EPM 2024 November Security Update and the EPM 2022 SU6 November Security Update. Refer to the Ivanti Security Advisory EPM November 2024 for download links and installation guidance. Ivanti EPM 2022 releases prior to SU6 must be updated to SU6 with the November security update applied.
Workarounds
- No official workaround has been published by Ivanti; patching is the required remediation
- Enforce least privilege for EPM service accounts and administrators to limit the impact of code execution if exploitation occurs
- Segment EPM management infrastructure from general user networks and apply strict egress filtering to constrain post-exploitation activity
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
