CVE-2024-13159

What it actually does

CVE-2024-13159 is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote, unauthenticated attacker to request files outside the intended web/application directory. By manipulating path components in HTTP requests, an attacker can cause the EPM server to disclose sensitive local files that the service account can read. The flaw is an information disclosure issue, but leaked configuration data, credentials, keys, logs, or environment details can enable follow-on compromise of EPM-managed infrastructure.

Why it matters to the business

Successful exploitation can expose sensitive operational data from an endpoint-management platform, including configuration files, credentials, internal paths, and details about managed systems. Because Ivanti EPM is commonly privileged in enterprise environments, disclosure from the server can materially increase the risk of broader endpoint compromise, credential theft, lateral movement, and disruption of endpoint operations. The vulnerability is listed in CISA KEV, has active exploitation in the wild, and has a very high EPSS score, so organizations should treat internet-accessible or unpatched EPM deployments as urgent exposure requiring immediate remediation. CISA’s KEV remediation deadline was 2025-03-31.

How an attack unfolds

An attacker first identifies an exposed Ivanti EPM service and sends crafted unauthenticated HTTP requests containing absolute or traversal-style path references. If the server fails to correctly validate and constrain the requested path, it reads and returns files from arbitrary locations on the underlying system rather than only approved application resources. The attacker then enumerates high-value files such as application configuration, logs, credential stores, scripts, and service metadata. Information obtained from these files may be used to discover secrets, understand internal topology, impersonate services, or prepare additional attacks against the EPM server or systems managed by EPM. Public reporting and KEV inclusion indicate that exploitation has occurred in the wild, so attempts may range from opportunistic scanning to targeted post-disclosure data collection.

How to fix it

Apply Ivanti’s January 2025 security updates for Endpoint Manager immediately. Systems running Ivanti EPM before the 2024 January-2025 Security Update, or EPM 2022 before SU6 January-2025 Security Update, should be considered vulnerable until updated. If immediate patching is not possible, restrict access to EPM interfaces to trusted administrative networks or VPNs, block direct internet exposure, enforce strong perimeter filtering, and monitor for traversal-style requests. Rotate any credentials, API keys, service account secrets, certificates, or tokens that may have been stored on or accessible from the EPM server if exploitation is suspected. After patching, review server configuration to ensure least-privilege filesystem permissions for the EPM service account and remove unnecessary sensitive files from web-accessible application paths.

How to confirm the fix worked

Confirm the installed Ivanti EPM build reflects the January 2025 security update level: 2024 January-2025 Security Update or 2022 SU6 January-2025 Security Update, as applicable. Validate that EPM web interfaces are not publicly reachable unless explicitly required and protected by network controls. Review vulnerability scanner results for CVE-2024-13159 and verify they report the host as remediated. Where safe and authorized, perform a controlled validation using benign traversal test cases to ensure absolute paths and traversal sequences are rejected and do not return local file contents. Confirm web/application logs no longer show successful responses for requests containing traversal patterns, encoded path traversal payloads, or absolute filesystem paths.

Typical attack path

1. Identify externally reachable Ivanti Endpoint Manager services through scanning, search engines, or prior reconnaissance.
2. Send unauthenticated HTTP requests containing crafted absolute path or directory traversal sequences to vulnerable EPM endpoints.
3. Confirm vulnerability by retrieving a benign readable file or observing file-disclosure behavior.
4. Enumerate sensitive files such as configuration files, application logs, credential material, certificates, scripts, and server metadata.
5. Use disclosed information to map the environment, recover secrets, or plan follow-on access against the EPM server or managed endpoints.
6. Cover tracks where possible by blending requests into normal web traffic or using distributed scanning infrastructure.

How to detect it

Investigate web server, Ivanti EPM application, reverse proxy, WAF, load balancer, and EDR telemetry for unauthenticated requests containing absolute filesystem paths, directory traversal sequences, encoded traversal payloads, or attempts to retrieve sensitive Windows and application files. Prioritize HTTP 200 responses or unusually sized responses to suspicious paths, especially from unknown external IPs, scanners, anonymization services, or requests lacking normal browser headers. Review EPM application logs for file-read errors, unexpected access to configuration files, and repeated probing across different paths. On the host, examine EDR/file access telemetry for the EPM service process reading unusual local files outside its application directory shortly before outbound responses. If exploitation is suspected, collect volatile evidence and preserve web logs, application logs, Windows Event Logs, EDR process/file telemetry, and any WAF captures. Look for post-exploitation activity following disclosure, such as credential use from unusual sources, new administrative logins, suspicious outbound connections, archive creation, or unexpected access to managed endpoint data. Threat intelligence should treat references to active exploitation of the Ivanti EPM absolute path traversal vulnerability as relevant context, but detection should focus on path traversal request patterns and file disclosure artifacts.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• C:/Windows/win.ini
• C:/Windows/System32/drivers/etc/hosts
• boot.ini
• web.config
• appsettings.json
• .env
• id_rsa
• id_dsa
• authorized_keys
• applicationHost.config
• win.ini

What your security team should do

• Patch Ivanti EPM to the January 2025 security update level immediately, prioritizing any internet-facing systems.
• Because this vulnerability is in CISA KEV and actively exploited, perform compromise assessment on vulnerable EPM servers, not just routine patch validation.
• Restrict EPM administrative and web access to trusted networks, VPNs, or allowlisted management hosts; remove unnecessary internet exposure.
• Search historical web, reverse proxy, WAF, EDR, and application logs for traversal attempts and suspicious file-disclosure requests dating back at least to public disclosure, and longer if logs are available.
• Rotate credentials, service account passwords, API tokens, and certificates that may be present in EPM configuration or readable files if exploitation cannot be ruled out.
• Add SIEM and WAF detections for absolute path traversal attempts, including encoded variants and requests for common sensitive Windows and application configuration files.
• Review EPM service account filesystem permissions and reduce access to only files required for normal operation.
• Track Ivanti advisories for related EPM vulnerabilities and apply cumulative security updates promptly.