Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE

MetasploitMetasploit exploitExploitRubyexploit_linux/http/ivanti_epmm_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits an unauthenticated OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) to achieve remote code execution with root privileges.

Backdoor review

No backdoor observed in reviewed code

The Metasploit module source code implements a standard exploit for CVE-2026-1281 and CVE-2026-1340. It sends a crafted HTTP request with a command injection payload to achieve unauthenticated RCE. No backdoor, deceptive payload, or concealed operator-directed harm is present. The module's behavior is consistent with its stated purpose.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareIvanti Endpoint Manager Mobile (EPMM)
Attack typesOS command injectionRemote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively injects OS commands to achieve remote code execution. It includes both a check method for vulnerability detection and an exploit method for payload delivery.

modules/exploits/linux/http/ivanti_epmm_rce.rb:1-146

Requirements

  • Target must be running a vulnerable version of Ivanti EPMM.modules/exploits/linux/http/ivanti_epmm_rce.rb:19-20

Observed behavior

  • Sends a crafted HTTP GET request to the /mifs/c/appstore/fob/3/ endpoint with a malicious 'h' parameter containing a command injection payload.modules/exploits/linux/http/ivanti_epmm_rce.rb:118-144
  • The check method verifies vulnerability by injecting a sleep command and measuring response time.modules/exploits/linux/http/ivanti_epmm_rce.rb:97-111
  • The exploit method executes an arbitrary command payload via the injection point.modules/exploits/linux/http/ivanti_epmm_rce.rb:113-115
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection
gPath[`#{cmd}`]The module injects the attacker-supplied command into the 'h' parameter using backticks, which is the core exploit mechanism.modules/exploits/linux/http/ivanti_epmm_rce.rb:122
Payload Execution
execute_cmd(payload.encoded)The exploit method executes the user-selected Metasploit payload, which is standard exploit behavior.modules/exploits/linux/http/ivanti_epmm_rce.rb:114
Check Method
sleep-based timing checkThe check method uses a sleep command to verify vulnerability via response timing, a common non-destructive technique.modules/exploits/linux/http/ivanti_epmm_rce.rb:97-101
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided Ruby source code and metadata; no dynamic execution or external library code was inspected.
  • Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were not inspected; metadata-only analysis was performed for non-text content (none present in this artifact).
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2