CVE-2024-37381: Ivanti Endpoint Manager SQLi Vulnerability

CVE-2024-37381 Overview

CVE-2024-37381 is an SQL Injection vulnerability affecting the Core server component of Ivanti Endpoint Manager (EPM) 2024 flat. This security flaw allows an authenticated attacker positioned within the same network to inject malicious SQL queries, potentially leading to arbitrary code execution on the affected system.

Critical Impact

Authenticated attackers on an adjacent network can leverage this SQL Injection vulnerability to execute arbitrary code, potentially compromising the entire endpoint management infrastructure and all managed endpoints.

Affected Products

• Ivanti Endpoint Manager 2024 (flat release)

Discovery Timeline

• 2024-07-29 - CVE-2024-37381 published to NVD
• 2025-07-10 - Last updated in NVD database

Technical Details for CVE-2024-37381

Vulnerability Analysis

This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The Core server component of Ivanti EPM 2024 fails to properly sanitize user-supplied input before incorporating it into SQL queries. When an authenticated attacker submits specially crafted input containing SQL metacharacters, the application constructs and executes unintended database commands.

The attack requires the adversary to have valid credentials and network adjacency to the target system. Once these prerequisites are met, successful exploitation can result in unauthorized data access, modification of database contents, and ultimately arbitrary code execution on the underlying server. Given that Ivanti EPM manages endpoints across an organization, compromise of this system could provide attackers with a strategic foothold for lateral movement and broader network compromise.

Root Cause

The root cause of CVE-2024-37381 stems from insufficient input validation and improper parameterization of SQL queries within the Ivanti EPM Core server. User-controlled data is concatenated directly into SQL statements without adequate sanitization or the use of prepared statements with parameterized queries, allowing attackers to break out of the intended query context and inject their own SQL commands.

Attack Vector

The attack vector for this vulnerability is classified as Adjacent Network, meaning the attacker must have access to the same network segment as the vulnerable Ivanti EPM Core server. The exploitation process involves:

1. An attacker first authenticates to the Ivanti EPM system using valid credentials (low privilege level required)
2. The attacker identifies input fields or API endpoints that interact with the database
3. Malicious SQL payloads are crafted and submitted through these entry points
4. The unsanitized input is incorporated into SQL queries executed by the Core server
5. Successful injection allows the attacker to manipulate database operations and potentially achieve code execution

The vulnerability does not require user interaction and can be exploited with low attack complexity once the authentication and network positioning requirements are met.

Detection Methods for CVE-2024-37381

Indicators of Compromise

• Unusual SQL error messages or database exceptions in Ivanti EPM Core server logs
• Unexpected database queries containing SQL injection patterns such as UNION SELECT, '; DROP, or encoded SQL metacharacters
• Anomalous authentication patterns followed by database-intensive operations
• New or modified stored procedures, functions, or database objects that were not administratively created

Detection Strategies

• Deploy database activity monitoring (DAM) solutions to identify suspicious query patterns targeting the Ivanti EPM database
• Implement network intrusion detection signatures to identify SQL injection payloads in traffic destined for the EPM Core server
• Enable detailed logging on the Ivanti EPM Core server and correlate with database audit logs to identify injection attempts
• Monitor for process spawning from database service accounts that may indicate successful code execution

Monitoring Recommendations

• Establish baseline database query patterns for the Ivanti EPM Core server and alert on statistical anomalies
• Configure SIEM rules to correlate authentication events with subsequent database errors or unusual query volumes
• Implement web application firewall (WAF) rules to filter common SQL injection attack patterns if the Core server exposes web interfaces
• Regularly review database user permissions and audit trails for evidence of privilege escalation or unauthorized data access

How to Mitigate CVE-2024-37381

Immediate Actions Required

• Apply the security patch provided by Ivanti as documented in the July 2024 Security Advisory for EPM 2024
• Restrict network access to the Ivanti EPM Core server to only authorized administrative workstations and systems
• Review authentication logs for any suspicious access attempts and rotate credentials for all EPM administrator accounts
• Implement network segmentation to isolate the EPM infrastructure from general user networks

Patch Information

Ivanti has released a security update addressing CVE-2024-37381 as part of their July 2024 security advisory for EPM 2024. Organizations should consult the Ivanti Security Advisory EPM July 2024 for detailed patch instructions and download the appropriate hotfix for their environment. It is critical to apply this patch promptly given the potential for arbitrary code execution.

Workarounds

• Implement strict network access controls using firewalls or VLANs to limit adjacent network access to the EPM Core server
• Apply the principle of least privilege to all EPM user accounts to minimize the impact of credential compromise
• Deploy a web application firewall (WAF) or database firewall with SQL injection detection capabilities as an additional defensive layer
• Consider temporarily disabling non-essential features or interfaces of the EPM Core server until patching can be completed

# Network segmentation example - restrict access to EPM Core server
# Example iptables rules to limit adjacent network access
iptables -A INPUT -s 10.0.0.0/24 -d <EPM_SERVER_IP> -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d <EPM_SERVER_IP> -p tcp --dport 1433 -j DROP
iptables -A INPUT -d <EPM_SERVER_IP> -j DROP