Back
Critical Vulnerability Discovered in Ivanti Endpoint Manager

Critical Vulnerability Discovered in Ivanti Endpoint Manager

WARNING Publication date: 2024-09-12

Similar to CrowdStrike a few weeks ago another endpoint management system has been compromised, this time it is Ivanti. If there ever was a reason not to use an active agent system on your infrastructure this is it. The problems with Ivanti have been ongoing for a while, with Chinese hacker groups repeatedly developing exploits.

The Problem

A newly discovered critical vulnerability in Ivanti Endpoint Manager (EPM) has raised alarm across the cybersecurity community. This flaw, identified as CVE-2024-29847, has a maximum severity rating of 10.0 on the CVSS scale, indicating its potential to cause severe damage if exploited. This vulnerability, along with several other critical flaws, allows unauthenticated attackers to execute remote code on affected EPM servers, putting organizations at significant risk.

Summary of the Vulnerability

Ivanti Endpoint Manager is a widely used platform for managing devices such as laptops, smartphones, and servers within organizations. The platform's server communicates with agents installed on these devices, enabling centralized control and management. The newly identified vulnerability specifically affects the agent portal of EPM, where deserialization of untrusted data can be exploited by remote attackers to run arbitrary code on the server. This could potentially allow attackers to take full control of the system, leading to data breaches, disruption of services, or worse.

In addition to CVE-2024-29847, the September 2024 security update addresses multiple SQL injection vulnerabilities (CVE-2024-32840 through CVE-2024-34785) with CVSS scores of 9.1, making them nearly as dangerous. These flaws allow attackers with administrative privileges to execute remote code, escalating their control over the affected systems.

Affected Versions

The following versions of Ivanti Endpoint Manager are affected by these vulnerabilities:

  • Ivanti Endpoint Manager 2024: The vulnerability affects versions without the September 2024 Security Hot Patch. Users must ensure they have applied both the July and September updates.
  • Ivanti Endpoint Manager 2022 and earlier: Versions prior to 2022 SU6 are affected. Users should upgrade to SU6 immediately.

Steps to Determine if You Are Affected

Organizations using Ivanti Endpoint Manager should take the following steps to quickly determine if they are affected:

Check Your Version: Verify the version of Ivanti Endpoint Manager in use. If you are running EPM 2024 without the September 2024 Security Hot Patch or any version of EPM 2022 SU5 or earlier, your system is vulnerable.

Review Patch Status: Ensure that you have applied the latest updates. For EPM 2024, this means the September 2024 Security Hot Patch. For EPM 2022, ensure you have upgraded to SU6.

Monitor Logs for Suspicious Activity: Although there are no known active exploits at the time of this disclosure, it's crucial to monitor your system logs for any unusual activity, particularly around the agent portal and management console.

Apply the Hot Patch: For EPM 2024 users, Ivanti has released a Security Hot Patch that must be applied immediately. This patch can be downloaded from Ivanti's portal and applied by following the provided instructions. A reboot of the Core Server is required after applying the patch.

Upgrade to the Latest SU: For users of older versions, upgrading to the latest Service Update (SU6 for 2022) is critical to closing the vulnerability.

Why Immediate Action is Crucial

While Ivanti has stated that there is no evidence of these vulnerabilities being exploited in the wild, the critical nature of these flaws means that the window for attackers to develop and deploy exploits could be very short. Previous vulnerabilities in Ivanti products have been actively exploited in targeted attacks, particularly by nation-state actors. Failure to apply the necessary patches could leave your organization vulnerable to remote code execution, unauthorized access, and potential data breaches.

Conclusion

Given the severity of these vulnerabilities, it is imperative that all organizations using Ivanti Endpoint Manager take immediate action. Ensure your systems are up to date with the latest patches and continue to monitor Ivanti's advisories for any further updates. If you are unsure about the status of your patches or need assistance, contact Ivanti support or consult with your cybersecurity team.

Protecting your organization's infrastructure is paramount, and addressing these vulnerabilities promptly is a critical step in safeguarding your data and systems.

Addendum: Related CVEs

For a detailed analysis of the vulnerabilities mentioned in this article, including their potential impact and mitigation strategies, please visit the following reports on our website:

  • CVE-2024-29847
  • CVE-2024-32840
  • CVE-2024-32842
  • CVE-2024-32843
  • CVE-2024-32845
  • CVE-2024-32846
  • CVE-2024-32848
  • CVE-2024-34779
  • CVE-2024-34783
  • CVE-2024-34785

Stay informed and secure by regularly checking these detailed CVE reports for the latest updates and recommendations.