CVE-2024-7593
CRITICAL KEV NUCLEIIvanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)
Title source: metasploitExploitation Summary
CVE-2024-7593 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 24, 2024.
EIP tracks 7 public exploits from researchers including D3N14LD15K, rxerium, intel365, including a Metasploit module auxiliary/admin/http/ivanti_vtm_admin.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Bash script exploits an authentication bypass vulnerability in Ivanti vTM (CVE-2024-7593) by creating a new admin user via a crafted POST request. It uses curl to send the payload and checks the response for success.
Description
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Exploits (7)
This Bash script exploits an authentication bypass vulnerability in Ivanti vTM (CVE-2024-7593) by creating a new admin user via a crafted POST request. It uses curl to send the payload and checks the response for success.
This repository provides a Nuclei template for detecting CVE-2024-7593, an authentication bypass vulnerability in Ivanti Virtual Traffic Manager. It matches specific versions and a login page string to identify vulnerable hosts.
The repository contains a functional exploit for CVE-2024-7593, an authentication bypass vulnerability in Ivanti Virtual Traffic Manager (vTM). The exploit uses a YAML-based Nuclei template to create a local admin user and then authenticate as that user, bypassing authentication.
The repository contains a functional exploit for CVE-2024-7593, an authentication bypass vulnerability in Ivanti vTM. The exploit uses a YAML-based HTTP request sequence to create an admin user and then authenticate as that user, bypassing the authentication mechanism.
This repository contains a writeup for CVE-2024-7593, a critical RCE vulnerability in Pulse Secure VPN. It includes technical details, affected versions, mitigation measures, and search dorks for identifying vulnerable systems.
The repository contains a functional exploit for CVE-2024-7593, an authentication bypass vulnerability in Ivanti vTM. The YAML file includes HTTP requests to create a local admin user and bypass authentication, demonstrating the vulnerability.
This Metasploit module exploits an authentication bypass vulnerability in Ivanti Virtual Traffic Manager (vTM) by adding a new administrative user via a crafted POST request. It verifies the vulnerability by checking the version and confirms successful exploitation by logging in with the newly created credentials.
Nuclei Templates (1)
http.favicon.hash:1862800928 || html:"apps/zxtm/login.cgi"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H