CVE-2021-44529
CRITICAL KEV RANSOMWARE NUCLEIIvanti Endpoint Manager Cloud Services Appliance < 4.5 - Unauthenticated Remote Code Execution
Title source: llmExploitation Summary
CVE-2021-44529 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2024, with confirmed use in ransomware campaigns.
EIP tracks 4 public exploits from researchers including d7x, jkana, jax7sec, including a Metasploit module exploits/linux/http/ivanti_csa_unauth_rce_cve_2021_44529.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages a remote code execution vulnerability in Ivanti Endpoint Manager 4.6 by injecting a base64-encoded command into a cookie parameter. The payload is executed server-side, and the output is retrieved via a specific HTML tag in the response.
Description
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Exploits (4)
This exploit leverages a remote code execution vulnerability in Ivanti Endpoint Manager 4.6 by injecting a base64-encoded command into a cookie parameter. The payload is executed server-side, and the output is retrieved via a specific HTML tag in the response.
This exploit leverages a command injection vulnerability in Ivanti Cloud Service Appliance (CSA) by encoding a malicious command in a base64 cookie, which is then executed on the target server. The response is parsed to extract the command output.
This PoC exploits a code injection vulnerability in Ivanti EPM Cloud Services Appliance (CSA) by encoding a system command in base64 and passing it via a cookie, allowing unauthenticated arbitrary code execution with limited privileges (nobody). The script sends a crafted request and extracts the command output from the response.
This Metasploit module exploits a command injection vulnerability in Ivanti Cloud Services Appliance (CSA) before version 4.6.0-512. It leverages a cookie-based code injection to execute arbitrary commands as the 'nobody' user.
Nuclei Templates (1)
title:"LANDesk(R) Cloud Services Appliance" || http.title:"landesk(r) cloud services appliance"
title="landesk(r) cloud services appliance"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H