Exploitation Summary
CVE-2024-29824 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 2, 2024.
EIP tracks 3 public exploits from researchers including horizon3ai, R4be1, James Horseman, Christophe De La Fuente, including a Metasploit module exploits/windows/http/ivanti_epm_recordgoodapp_sqli_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits a SQL injection vulnerability in Ivanti EPM via a crafted SOAP request, enabling blind remote command execution through `xp_cmdshell`. The exploit sends commands from a file to the target endpoint `/WSStatusEvents/EventHandler.asmx`.
Description
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Exploits (3)
This PoC exploits a SQL injection vulnerability in Ivanti EPM via a crafted SOAP request, enabling blind remote command execution through `xp_cmdshell`. The exploit sends commands from a file to the target endpoint `/WSStatusEvents/EventHandler.asmx`.
This PoC exploits CVE-2024-29824, a SQL injection vulnerability in a SOAP endpoint, leading to remote command execution via `xp_cmdshell`. It supports both single-target and multi-target exploitation using a thread pool for efficiency.
This Metasploit module exploits an unauthenticated SQL injection vulnerability in Ivanti Endpoint Manager (EPM) 2022 SU5 and prior, leveraging `xp_cmdshell` to achieve remote code execution via a crafted SOAP request.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H