CVE-2024-13160

What it actually does

This vulnerability is an unauthenticated absolute path traversal flaw in Ivanti Endpoint Manager. A remote attacker can craft requests that cause the vulnerable application to read files outside the intended web or application directory. The primary technical impact is sensitive information disclosure, such as configuration files, logs, application data, credentials, keys, or other readable files accessible to the Ivanti EPM service account. The flaw does not inherently provide code execution, but exposed secrets can be used to support follow-on authentication, lateral movement, or chaining with other vulnerabilities.

Why it matters to the business

Organizations running affected Ivanti Endpoint Manager versions risk unauthorized disclosure of sensitive management-server data. Because EPM often has broad endpoint-management visibility and privileged operational context, leaked files may expose credentials, infrastructure details, or deployment information that can materially increase the impact of a broader intrusion. This issue is listed in CISA KEV, has active in-the-wild exploitation, and has a very high EPSS score, so internet-exposed or broadly reachable EPM systems should be treated as urgent remediation priorities. CISA’s KEV remediation due date was 2025-03-31, meaning any remaining unpatched exposure is overdue.

How an attack unfolds

An attacker first identifies an accessible Ivanti Endpoint Manager service, commonly through internet scanning, asset discovery, or prior knowledge of exposed management infrastructure. The attacker then sends specially crafted unauthenticated HTTP requests containing absolute file paths or encoded traversal sequences intended to escape the application’s permitted file-access directory. If the target is vulnerable, the server returns the contents of files that should not be remotely accessible. The attacker can repeatedly request high-value files such as configuration files, logs, credential stores, application secrets, or operating-system files readable by the EPM process. Any recovered credentials, tokens, hostnames, or internal paths can then be used to plan credential theft, lateral movement, privilege escalation, or additional exploitation against endpoint-management infrastructure. Active exploitation has been observed in the wild, so suspicious traversal probes against EPM should be investigated as potential compromise attempts, not just background scanning.

How to fix it

Upgrade Ivanti Endpoint Manager to a fixed release immediately. Ivanti identifies remediation as the 2024 January-2025 Security Update for supported 2024 deployments and the 2022 SU6 January-2025 Security Update for supported 2022 SU6 deployments. If immediate patching is not possible, restrict network access to EPM to trusted administrative networks only, place the service behind VPN or strong access controls, block direct internet exposure, and apply WAF or reverse-proxy rules that deny absolute-path and traversal payloads. Rotate credentials, API keys, service-account passwords, and certificates that may have been stored in files readable by the EPM service if exploitation is suspected. Because this is a KEV-listed actively exploited vulnerability, compensating controls should be considered temporary only.

How to confirm the fix worked

Confirm the installed Ivanti EPM version and applied security update from the product console, server inventory, vendor update records, or package management evidence. Validate that the deployment is at or beyond the 2024 January-2025 Security Update or 2022 SU6 January-2025 Security Update, as applicable. Review external exposure using attack-surface management, vulnerability scanners, and firewall or load-balancer inventories to ensure EPM is not publicly reachable unless explicitly required and protected. Where authorized, perform a controlled non-destructive validation using safe traversal test payloads that attempt to read a benign file and confirm the server does not return file contents outside the intended application path. Re-run vulnerability scanning after patching and confirm WAF or reverse-proxy controls log and block traversal patterns.

Typical attack path

1. Discover an Ivanti Endpoint Manager instance exposed to the internet or reachable from a compromised network segment.
2. Fingerprint the service and determine whether it appears to be running a pre-January-2025 vulnerable version.
3. Send unauthenticated requests containing absolute paths, directory traversal sequences, or URL-encoded traversal payloads.
4. Confirm vulnerability by receiving file contents from outside the intended application directory.
5. Target sensitive files such as configuration files, logs, credential material, certificates, keys, or system files readable by the service account.
6. Use disclosed information to support follow-on access, credential attacks, lateral movement, or chaining with other vulnerabilities.

How to detect it

Review IIS, web server, reverse-proxy, WAF, load-balancer, and Ivanti EPM application logs for unauthenticated requests containing absolute file paths, path traversal sequences, URL-encoded traversal, double-encoded traversal, or attempts to retrieve known sensitive files. Prioritize events where the response status is 200 or 206, response size is non-trivial, or many distinct file paths are requested from the same source. Look for requests containing Windows paths, Unix paths, drive letters, encoded slashes or backslashes, and repeated traversal markers. Correlate suspicious requests with subsequent authentication events, administrative actions in EPM, outbound connections from the EPM server, credential use from new IP addresses, and creation or modification of accounts, packages, scripts, or deployment tasks. Because the vulnerability is information disclosure, successful exploitation may leave no malware artifact; web access logs and downstream credential-use telemetry are the most important evidence sources.

• ../
• ..\\
• ..%2f
• ..%2F
• ..%5c
• ..%5C
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• C:\\Windows\\win.ini
• C:%5cWindows%5cwin.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• C:%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts
• boot.ini
• web.config
• appsettings.json
• connectionStrings
• LANDESK
• ManagementSuite

What your security team should do

• Treat this as a high-priority remediation item because it is CISA KEV-listed, actively exploited in the wild, and has a very high EPSS probability.
• Patch all affected Ivanti Endpoint Manager servers to the applicable January-2025 security update immediately.
• Remove direct internet exposure for EPM management interfaces and restrict access to trusted administrative networks or VPN-protected paths.
• Hunt historical web, reverse-proxy, WAF, and EPM logs for traversal and absolute-path access patterns, especially requests returning HTTP 200, 206, or unusually large responses.
• Assume potentially exposed secrets may be compromised if suspicious requests are found; rotate EPM-related service credentials, API secrets, certificates, and privileged accounts as appropriate.
• Add WAF/SIEM detections for encoded and double-encoded traversal payloads targeting EPM endpoints.
• Review EPM server file permissions so the application service account cannot read unnecessary sensitive files.
• Monitor for downstream activity after possible disclosure, including new administrative logins, unusual endpoint-management actions, credential use from new sources, and lateral movement from or through the EPM server.