CISA Adds Ivanti Endpoint Manager Flaw to Known Exploited Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw affecting Ivanti Endpoint Manager (EPM) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The vulnerability, tracked as CVE-2024-29824, was originally patched in May but continues to pose a serious threat due to ongoing attacks.

With a CVSS score of 9.6, this SQL injection vulnerability in the Core server of Ivanti EPM 2022 SU5 and earlier versions enables an unauthenticated attacker on the same network to execute arbitrary code. Ivanti disclosed the issue in an advisory released on May 21, 2024.

Technical Details

According to cybersecurity firm Horizon3.ai, which released a proof-of-concept (PoC) exploit in June, the flaw is rooted in the RecordGoodApp() function of a DLL named PatchBiz.dll. The vulnerability allows an attacker to manipulate SQL queries, ultimately gaining remote code execution (RCE) using the xp_cmdshell command in Microsoft SQL Server.

While specifics on how this vulnerability is being exploited in the wild remain unclear, Ivanti has updated its security bulletin, confirming that the flaw has been actively exploited and that a "limited number of customers" have been targeted.

Other Ivanti Vulnerabilities Under Active Exploitation

This recent development highlights the growing interest in Ivanti appliances by cybercriminals, with four different vulnerabilities in the company’s products being actively abused in just the past month:

1. CVE-2024-8190 (CVSS score: 7.2) - An OS command injection vulnerability in Cloud Service Appliance (CSA).
2. CVE-2024-8963 (CVSS score: 9.4) - A path traversal vulnerability in CSA.
3. CVE-2024-7593 (CVSS score: 9.8) - An authentication bypass vulnerability in Virtual Traffic Manager (vTM).

Urgency of Patching

Federal agencies have been mandated to patch all affected Ivanti instances by October 23, 2024, to secure their networks against active threats. CISA's inclusion of CVE-2024-29824 in the KEV catalog underscores the critical nature of the vulnerability, urging organizations to update their systems immediately.

Recommendations

To protect against these active threats, CISA and Ivanti recommend the following steps:

1. Patch all affected devices to the latest versions immediately.
2. Disable xp_cmdshell on Microsoft SQL Server unless it is absolutely necessary.
3. Monitor network activity for any signs of abnormal behavior related to Ivanti appliances.
4. Use access control lists (ACLs) to restrict network access to Ivanti appliances.
5. Implement two-factor authentication (2FA) where possible to reduce the likelihood of unauthorized access.

With the rising number of vulnerabilities in Ivanti products being exploited, prompt action is crucial to prevent potential breaches and minimize damage to affected networks.