CVE-2024-7612: Ivanti EPMM Privilege Escalation Flaw

CVE-2024-7612 Overview

CVE-2024-7612 is a high-severity insecure permissions vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.1.0.4. This vulnerability allows a local authenticated attacker to modify sensitive application components due to improper permission controls (CWE-732: Incorrect Permission Assignment for Critical Resource). Successful exploitation could enable attackers with local access to escalate privileges, compromise application integrity, or disrupt mobile device management operations across an organization.

Critical Impact

Local authenticated attackers can modify sensitive EPMM application components, potentially leading to privilege escalation and compromise of enterprise mobile device management infrastructure.

Affected Products

• Ivanti Endpoint Manager Mobile (EPMM) versions before 12.1.0.4
• Ivanti EPMM appliances running vulnerable software versions
• Enterprise environments using affected EPMM deployments for mobile device management

Discovery Timeline

• October 8, 2024 - CVE-2024-7612 published to NVD
• December 18, 2024 - Last updated in NVD database

Technical Details for CVE-2024-7612

Vulnerability Analysis

This vulnerability stems from insecure permission configurations within Ivanti Endpoint Manager Mobile. The affected application fails to properly restrict access to sensitive application components, allowing authenticated local users to modify critical files or configurations that should be protected from unauthorized changes.

The vulnerability requires local access to the system and valid authentication credentials. Once authenticated, an attacker can leverage the improper permission assignments to modify application components that control core functionality. This could result in complete compromise of the EPMM application's confidentiality, integrity, and availability.

EPMM serves as a critical enterprise mobile device management (MDM) solution, making this vulnerability particularly concerning for organizations that rely on it to manage and secure their mobile fleet. Compromise of EPMM could potentially impact all managed mobile devices within an organization.

Root Cause

The root cause is CWE-732: Incorrect Permission Assignment for Critical Resource. Sensitive application components within Ivanti EPMM do not have appropriate file system permissions or access controls enforced, allowing local authenticated users to read from or write to resources that should be restricted to privileged accounts or the application service account only.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the system hosting Ivanti EPMM. The exploitation scenario involves:

1. Initial Access: Attacker obtains local authenticated access to the EPMM server or appliance
2. Permission Discovery: Attacker identifies sensitive application components with improper permissions
3. Component Modification: Attacker modifies critical application files, configurations, or binaries
4. Privilege Escalation: Modified components execute with elevated privileges or allow further system compromise

The vulnerability does not require user interaction and has low attack complexity once local access is achieved. For detailed technical information, refer to the Ivanti Security Advisory for CVE-2024-7612.

Detection Methods for CVE-2024-7612

Indicators of Compromise

• Unexpected modifications to EPMM application files, configurations, or binaries
• Changes to file permissions on sensitive EPMM components
• Anomalous local user activity on EPMM servers, particularly permission changes or file modifications
• Audit log entries indicating access to restricted EPMM directories by unauthorized users

Detection Strategies

• Enable file integrity monitoring (FIM) on EPMM application directories to detect unauthorized modifications
• Monitor Windows Security Event logs or Linux auditd for permission changes and file access events on EPMM components
• Deploy endpoint detection and response (EDR) solutions to identify suspicious local activity on EPMM servers
• Review application logs for unusual configuration changes or service restarts

Monitoring Recommendations

• Implement centralized logging for all EPMM server events and correlate with SIEM solutions
• Configure alerts for file system changes within EPMM installation directories
• Regularly audit local user accounts and their access levels on EPMM systems
• Monitor for privilege escalation attempts or unusual process execution on EPMM hosts

How to Mitigate CVE-2024-7612

Immediate Actions Required

• Upgrade Ivanti Endpoint Manager Mobile to version 12.1.0.4 or later immediately
• Audit current EPMM installations to verify version and vulnerability status
• Review and restrict local access to EPMM servers to only essential personnel
• Implement file integrity monitoring on EPMM systems until patching is complete

Patch Information

Ivanti has released a security patch addressing this vulnerability in EPMM version 12.1.0.4. Organizations should apply this update as soon as possible. Review the Ivanti Security Advisory for CVE-2024-7612 for complete patching instructions and additional guidance.

Workarounds

• Restrict local access to EPMM servers to minimize attack surface while awaiting patch deployment
• Review and harden file system permissions on sensitive EPMM directories and files
• Implement additional monitoring and alerting on EPMM systems to detect exploitation attempts
• Segment EPMM servers from general network access and limit administrative access paths

# Example: Verify Ivanti EPMM version and check for vulnerable installations
# Consult Ivanti documentation for specific version verification commands
# After verification, upgrade to 12.1.0.4 or later per vendor guidance

# Example file integrity monitoring setup (Linux-based systems)
# Install and configure AIDE or similar FIM tool
aide --init
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
aide --check