CVE-2024-50330: Ivanti Endpoint Manager RCE Vulnerability

CVE-2024-50330 Overview

CVE-2024-50330 is a critical SQL injection vulnerability affecting Ivanti Endpoint Manager (EPM) that allows remote unauthenticated attackers to achieve remote code execution. This vulnerability exists in versions prior to the 2024 November Security Update and the 2022 SU6 November Security Update. The flaw enables attackers to inject malicious SQL queries through the network without requiring any authentication or user interaction, potentially leading to complete system compromise.

Critical Impact

Remote unauthenticated attackers can exploit this SQL injection vulnerability to achieve full remote code execution on affected Ivanti Endpoint Manager systems, potentially compromising the entire managed endpoint infrastructure.

Affected Products

• Ivanti Endpoint Manager 2024 (prior to November 2024 Security Update)
• Ivanti Endpoint Manager 2022 (all service updates SU1 through SU5, prior to SU6 November Security Update)
• Ivanti Endpoint Manager 2022 (base version without security updates)

Discovery Timeline

• 2024-11-12 - CVE-2024-50330 published to NVD
• 2025-04-23 - Last updated in NVD database

Technical Details for CVE-2024-50330

Vulnerability Analysis

This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw allows remote attackers to manipulate SQL queries processed by the Ivanti Endpoint Manager application without requiring authentication. Due to the unauthenticated nature of this attack vector, any network-accessible EPM instance is potentially vulnerable.

The exploitation chain enables attackers to bypass input validation mechanisms and inject arbitrary SQL commands into the backend database. When successful, attackers can leverage database capabilities to escalate the attack to achieve remote code execution on the underlying server. This type of vulnerability is particularly dangerous in endpoint management solutions, as compromising the management server could provide attackers with access to credentials and control mechanisms for all managed endpoints across an organization.

Root Cause

The root cause of CVE-2024-50330 lies in improper input sanitization within Ivanti Endpoint Manager's query handling mechanisms. User-supplied input is not adequately validated or parameterized before being incorporated into SQL queries executed against the backend database. This failure to properly neutralize special SQL characters and syntax allows attackers to break out of intended query structures and execute arbitrary SQL commands.

Attack Vector

The attack vector for this vulnerability is network-based, meaning attackers can exploit it remotely without any authentication credentials or user interaction. An attacker with network access to a vulnerable Ivanti Endpoint Manager instance can craft malicious HTTP requests containing SQL injection payloads. These payloads, when processed by the vulnerable application components, can manipulate database queries to extract sensitive data, modify configurations, or leverage database features like xp_cmdshell (if using SQL Server) to achieve command execution on the underlying operating system.

The attack complexity is low, requiring only basic knowledge of SQL injection techniques and network access to the target system. No privileges or user interaction are required, making this vulnerability highly exploitable in internet-facing or internally accessible deployments.

Detection Methods for CVE-2024-50330

Indicators of Compromise

• Unusual SQL error messages in Ivanti EPM application logs indicating malformed queries or syntax errors
• Unexpected database queries containing SQL injection patterns such as UNION SELECT, '; DROP, or xp_cmdshell commands
• Anomalous network traffic to Ivanti EPM servers from unexpected sources or containing suspicious payloads
• Evidence of unauthorized database access, data exfiltration, or new administrative accounts created

Detection Strategies

• Deploy Web Application Firewall (WAF) rules specifically targeting SQL injection patterns in requests to Ivanti EPM endpoints
• Enable verbose logging on the Ivanti EPM application and database servers to capture detailed query information
• Implement network intrusion detection system (IDS) signatures for known SQL injection attack patterns
• Monitor database audit logs for unusual query patterns, especially those involving system tables or command execution

Monitoring Recommendations

• Continuously monitor Ivanti EPM server logs for authentication failures and suspicious request patterns
• Implement real-time alerting for database queries containing potentially malicious SQL syntax
• Track network connections to Ivanti EPM instances and alert on connections from untrusted IP ranges
• Establish baseline behavior for database query patterns and alert on significant deviations

How to Mitigate CVE-2024-50330

Immediate Actions Required

• Apply the Ivanti Endpoint Manager 2024 November Security Update or 2022 SU6 November Security Update immediately
• Restrict network access to Ivanti EPM servers to only authorized administrative networks until patching is complete
• Review Ivanti EPM and database logs for any signs of exploitation prior to patching
• Consider temporarily isolating the Ivanti EPM server from the network if immediate patching is not possible

Patch Information

Ivanti has released security updates to address CVE-2024-50330. Organizations running Ivanti Endpoint Manager 2024 should apply the November 2024 Security Update. Organizations running Ivanti Endpoint Manager 2022 (including SU1 through SU5) should upgrade to SU6 with the November Security Update. Detailed patching instructions and download links are available in the Ivanti Security Advisory EPM November 2024.

Workarounds

• Implement network segmentation to restrict access to the Ivanti EPM server from trusted networks only
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the Ivanti EPM instance
• Enable enhanced database logging and monitoring to detect exploitation attempts
• Consider disabling internet-facing access to Ivanti EPM until patches can be applied

# Network isolation example using iptables (temporary mitigation)
# Allow only trusted admin subnet to access EPM
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP