CVE-2024-13161

What it actually does

CVE-2024-13161 is an unauthenticated absolute path traversal vulnerability in Ivanti Endpoint Manager. A remote attacker can craft requests that cause the EPM server to read files outside the intended application directory, potentially exposing configuration files, credentials, tokens, logs, or other sensitive local files readable by the application or web service account. The flaw is primarily an information disclosure issue, but leaked secrets may enable follow-on authentication bypass, lateral movement, or compromise of managed endpoints depending on what files are exposed.

Why it matters to the business

Successful exploitation can expose sensitive operational data from an endpoint management platform, including credentials or configuration material that may help attackers expand access across managed devices. Because Ivanti EPM is commonly privileged in enterprise environments and this issue is listed in CISA KEV with active exploitation observed in the wild, exposed systems should be treated as high-priority even though the direct impact is information disclosure. The CISA remediation deadline was 2025-03-31, so unpatched internet-accessible instances represent overdue risk and may draw opportunistic scanning.

How an attack unfolds

An attacker first identifies an accessible Ivanti EPM service, often through internet scanning or reconnaissance of known management portals. They then send unauthenticated HTTP requests containing absolute path traversal sequences or encoded traversal variants that attempt to reference files outside the expected web or application directory. If the server is vulnerable, it returns the contents of the requested local file. The attacker repeats this against likely configuration, log, credential, key, and operating system files to collect secrets or environmental information. The disclosed data can then be used to plan additional attacks, such as credential reuse, database access, service impersonation, or targeted exploitation of the endpoint-management infrastructure and downstream managed systems.

How to fix it

Upgrade Ivanti Endpoint Manager to a fixed release immediately. Systems running Ivanti EPM 2024 should apply the January 2025 Security Update or later; systems running Ivanti EPM 2022 SU6 should apply the January 2025 Security Update or later. If immediate patching is not possible, remove direct internet exposure, restrict access to trusted administrative networks or VPNs, enforce network-layer allowlisting, and deploy WAF or reverse-proxy rules that block absolute path traversal patterns and encoded traversal sequences. After patching, rotate any credentials, API keys, certificates, database passwords, or service account secrets that may have been stored on or accessible from the EPM server, especially if logs show suspicious file-read attempts.

How to confirm the fix worked

Confirm the installed Ivanti EPM build includes the January 2025 Security Update or a later vendor-supported security update for the deployed branch. Validate that unauthenticated requests containing traversal sequences are rejected and do not return local file contents. Review external exposure using asset inventory, vulnerability scanners, and perimeter scans to ensure EPM administrative services are not publicly reachable unless explicitly required and strongly controlled. Confirm compensating controls such as WAF rules, allowlists, and reverse-proxy filters are active where applicable. Perform credential rotation validation by ensuring old service, database, and API credentials no longer authenticate.

Typical attack path

1. Scan for exposed Ivanti Endpoint Manager services or identify them from prior reconnaissance.
2. Send unauthenticated requests containing absolute path traversal payloads or encoded traversal sequences.
3. Confirm vulnerability by retrieving a harmless known local file or application file that should not be web-accessible.
4. Enumerate sensitive local files such as application configuration, logs, credential stores, certificates, and service account material.
5. Use recovered secrets or internal details to attempt authenticated access, lateral movement, or further exploitation of endpoint-management infrastructure.
6. Cover tracks by blending requests with normal web traffic or rotating source infrastructure.

How to detect it

Review HTTP access logs, reverse-proxy logs, WAF logs, load balancer logs, and Ivanti EPM application logs for unauthenticated requests containing path traversal sequences, encoded traversal sequences, Windows or Unix absolute paths, and sensitive file names. Prioritize requests that returned HTTP 200, 206, or unusually large response sizes, especially from unknown external IP addresses. Search for repeated probing of common files such as operating system metadata, web configuration files, application configuration files, log files, certificate stores, and credential material. In EDR telemetry, investigate the EPM web or application service process reading unusual files outside its normal application directories shortly after suspicious web requests. Because active exploitation has been reported, also hunt for post-disclosure activity: unexpected authentication from new locations, anomalous service account usage, database access using recovered credentials, creation of new admin accounts, and lateral movement originating from the EPM server.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• ..%2f
• ..%5c
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• web.config
• appsettings.json
• connectionStrings
• /WEB-INF/web.xml

What your security team should do

• Treat all internet-exposed Ivanti EPM instances as urgent because the vulnerability is in CISA KEV, has high EPSS likelihood, and is reported as actively exploited in the wild.
• Patch to the January 2025 Security Update or later for the applicable Ivanti EPM branch, prioritizing externally reachable systems first.
• If patching cannot be completed immediately, isolate EPM from the internet and limit access to trusted administrative sources only.
• Hunt historical web, proxy, WAF, and EDR telemetry for traversal attempts and suspicious file disclosure activity before assuming remediation is complete.
• Rotate credentials and secrets stored on or used by the EPM server if exploitation is suspected or logs are incomplete.
• Add SIEM detections for unauthenticated requests containing traversal strings, encoded traversal variants, and sensitive file names returning HTTP 200 or unusually large responses.
• Monitor for follow-on activity such as new administrative logins, unexpected database connections, anomalous service account use, and lateral movement from the EPM server.