CVE-2024-29823

What it actually does

CVE-2024-29823 is an unauthenticated SQL injection flaw in the Ivanti Endpoint Manager Core server affecting Ivanti EPM 2022 SU5 and earlier. An attacker with network access to the Core server can send crafted requests that cause attacker-controlled SQL to execute against the backend database. Because the vulnerability is assessed as enabling arbitrary code execution, successful exploitation can move beyond data access or modification and result in command execution in the context of the application/database service, with high confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised Ivanti EPM Core server can become a high-value control point for endpoint compromise because EPM is used to manage software, inventory, agents, and administrative operations across fleets. Exploitation could allow theft or alteration of endpoint management data, disruption of endpoint management services, tampering with deployment workflows, and potential lateral movement into managed systems. The very high EPSS score indicates broad likelihood of exploitation activity even though it is not currently listed in CISA KEV, so organizations should treat exposed or broadly reachable Core servers as urgent remediation targets.

How an attack unfolds

An attacker first gains network reachability to the Ivanti EPM Core server, typically from an internal network segment, VPN foothold, compromised workstation, or other adjacent host. The attacker identifies the EPM service and sends crafted unauthenticated requests containing SQL injection payloads to the vulnerable Core server component. The injected SQL is processed by the backend database, allowing the attacker to read or modify data and, where database/application permissions permit, invoke mechanisms that lead to operating-system command execution. After code execution, the attacker may establish persistence, dump credentials or application secrets, enumerate managed endpoints, alter deployment or inventory data, and use the EPM server’s trusted position to move laterally or stage further attacks.

How to fix it

Upgrade Ivanti EPM to a vendor-supported version that contains the fix for CVE-2024-29823; Ivanti EPM 2022 SU5 and earlier should be considered vulnerable. If an exact fixed build is required for change control, validate it against the current Ivanti advisory and install the latest available service update or cumulative security update rather than remaining on SU5 or earlier. Until patched, restrict network access to the Core server to only required administrative and agent networks, block unauthenticated access from user subnets and VPN pools where possible, enforce firewall allowlists, and monitor for SQL injection attempts. Review database service permissions and disable risky database features that enable operating-system command execution where they are not required. Because exploitation may lead to full server compromise, systems with suspicious activity should be isolated and investigated before being returned to service.

How to confirm the fix worked

Confirm the installed Ivanti EPM Core server version is newer than the vulnerable 2022 SU5-or-earlier release line and matches a vendor-patched build. Validate that the Core server is not reachable from untrusted internal segments, guest networks, or broad VPN address ranges unless explicitly required. Review vulnerability scanner results, asset inventory, and software version inventory for Ivanti EPM Core installations. Where safe and authorized, use a non-destructive vulnerability check from a trusted scanner or vendor-provided validation method rather than manual SQL injection probing in production. Confirm database hardening by verifying that high-risk command-execution features are disabled or tightly restricted and that the application database account does not have unnecessary administrative privileges.

Typical attack path

1. Obtain network access to the same network or routed segment as the Ivanti EPM Core server.
2. Discover the Ivanti EPM Core server and identify reachable application services.
3. Send crafted unauthenticated requests containing SQL injection payloads to the vulnerable Core server component.
4. Use SQL injection to enumerate database structure, extract sensitive data, or modify records.
5. Escalate from database-level execution to arbitrary command execution where supported by the backend configuration and service privileges.
6. Deploy tooling, create persistence, access credentials, or pivot through the EPM server’s management role.
7. Use the compromised management infrastructure to disrupt operations, tamper with endpoint management workflows, or move laterally to managed systems.

How to detect it

Investigate whether exploitation occurred by correlating Ivanti EPM application/Core server logs, web server access logs if applicable, Microsoft SQL Server logs and audit events, Windows Security and System event logs, PowerShell logs, scheduled task/service creation events, and EDR process telemetry. Look for unauthenticated requests containing SQL metacharacters or time-delay probes, repeated database error responses, unusually long or encoded request parameters, and requests from non-administrative workstations or VPN ranges. In database logs, look for unexpected use of system stored procedures, attempts to enable command-execution features, UNION-based enumeration, stacked queries, or time-delay primitives such as WAITFOR DELAY. On the Core server, hunt for child processes spawned by database or application service processes, including cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, curl.exe, or bitsadmin.exe. Also review for new local users, new services, scheduled tasks, suspicious temporary files, modified EPM packages/scripts, and unexpected outbound connections following suspicious inbound requests.

• UNION SELECT
• WAITFOR DELAY
• xp_cmdshell
• sp_configure 'xp_cmdshell'
• EXEC master..xp_cmdshell
• INFORMATION_SCHEMA
• sysobjects
• sqlmap
• ' OR 1=1--
• " OR "1"="1
• ;--
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• mshta.exe
• certutil.exe -urlcache
• bitsadmin /transfer

What your security team should do

• Prioritize patching Ivanti EPM Core servers running 2022 SU5 or earlier, especially those reachable from broad internal networks or VPN users.
• Restrict inbound access to the EPM Core server using firewall rules, network segmentation, and administrative allowlists until all systems are confirmed patched.
• Treat any exposed vulnerable Core server as a potential compromise candidate because the EPSS score indicates very high exploitation probability.
• Collect and preserve web/application logs, database audit logs, Windows event logs, and EDR telemetry before patching if exploitation is suspected.
• Hunt for SQL injection payloads, unusual database errors, unexpected database configuration changes, command-shell invocation from database or application service processes, and new files or services created around suspicious request times.
• Review EPM administrative accounts, service accounts, deployment jobs, packages, scripts, and policy changes for unauthorized modifications.
• Rotate credentials or secrets accessible from the EPM server if compromise is confirmed or cannot be ruled out.
• After remediation, perform a targeted incident response review to ensure the Core server was not used for lateral movement or endpoint management abuse.