CVE-2024-29824

What it actually does

CVE-2024-29824 is an unauthenticated SQL injection vulnerability in the Ivanti Endpoint Manager Core server affecting Ivanti EPM 2022 SU5 and earlier. An attacker with network adjacency to the Core server can send crafted requests that alter backend SQL queries. Because the vulnerable component runs in a privileged management-server context, successful exploitation can lead beyond data access to arbitrary code execution on the EPM Core server, with potential compromise of endpoint-management functions, stored credentials, managed-device inventory, deployment tasks, and administrative control paths.

Why it matters to the business

Compromise of an endpoint-management platform can have broad operational impact because the server is commonly trusted to inventory, configure, patch, and deploy software to many endpoints. A successful attacker may gain control over the management server, access sensitive asset and credential data, tamper with endpoint-management policies, disrupt patching or software distribution, and potentially use the platform to move laterally. This vulnerability is listed in CISA KEV with a remediation due date of 2024-10-23, has a very high EPSS score of 0.99951, and is reported as actively exploited in the wild, so exposed systems should be treated as high-priority remediation targets even though ransomware use is not currently indicated.

How an attack unfolds

An attacker first obtains network reachability to the Ivanti EPM Core server from the same or adjacent network segment. They then send crafted unauthenticated requests to the vulnerable Core server functionality, embedding SQL syntax that changes the intended database query. If the injected SQL executes, the attacker can enumerate database contents, modify application state, and attempt to invoke database or application features that cause operating-system command execution. In a successful end-to-end compromise, the attacker uses the SQL injection to execute commands or stage tooling on the Core server, establishes persistence or remote access, and then abuses the EPM server’s trusted role to access management data or pivot toward managed endpoints. Because exploitation is unauthenticated and active in the wild, suspicious activity should be assumed to include both initial SQL injection attempts and follow-on Windows post-exploitation behavior on the Core server.

How to fix it

Upgrade Ivanti Endpoint Manager to a vendor-supported fixed release later than EPM 2022 SU5; where available, apply Ivanti’s official security update or service update that remediates CVE-2024-29824. If immediate upgrade is not possible, restrict network access to the EPM Core server to only required administrative and managed-device subnets, block access from untrusted internal segments, enforce firewall rules around Core server services and the database tier, and monitor aggressively for SQL injection and command-execution indicators. Do not expose EPM Core services to the internet. Review Ivanti advisories for any required post-update steps, hotfix sequencing, or configuration changes. After patching, rotate credentials and secrets stored in or used by EPM if compromise is suspected, and validate that no attacker-created jobs, accounts, services, scheduled tasks, scripts, or web-accessible files remain.

How to confirm the fix worked

Confirm the installed Ivanti EPM version and service update level on every Core server and verify it is newer than the affected EPM 2022 SU5-and-prior release line or otherwise explicitly listed by Ivanti as fixed. Validate that the vulnerable Core server endpoints are not reachable from unauthorized network segments. Perform authenticated administrative checks to confirm the security update is installed, services restarted successfully, and EPM functions continue to operate. Review vulnerability scanner results only after confirming the scanner has a detection plugin that checks the patched build or vendor hotfix state rather than banner information alone. For exposure validation, test from representative adjacent-network locations to ensure only approved hosts can reach EPM Core services and that database services are not broadly reachable.

Typical attack path

1. Identify an Ivanti EPM Core server reachable from the same network or adjacent internal network.
2. Send crafted unauthenticated requests containing SQL injection payloads to the vulnerable Core server component.
3. Use the SQL injection to confirm database interaction and enumerate privileges, schema, or application data.
4. Escalate from SQL execution to operating-system command execution through database features, application workflows, or chained techniques.
5. Create or download payloads on the Core server, such as scripts, web-accessible files, remote access tools, or command shells.
6. Establish persistence through scheduled tasks, services, new accounts, SQL Agent jobs, startup items, or modified application configuration.
7. Access sensitive EPM data and use the management server’s trust relationship to support lateral movement or endpoint compromise.
8. Clean up obvious artifacts or blend activity with legitimate EPM administrative traffic.

How to detect it

Investigate Ivanti EPM Core server, web/service, SQL Server, Windows, PowerShell, Sysmon, EDR, firewall, and proxy logs for signs of exploitation. Start with the publication window and continue through the patch date, with extra attention to periods before the CISA KEV due date and any time the server was reachable from broad internal networks. In web or application logs, look for unauthenticated requests from unusual internal hosts containing SQL metacharacters, stacked queries, comment markers, time-delay functions, UNION-based probing, or URL-encoded SQL payloads. In SQL Server logs, audit/default trace/Extended Events, look for unusual execution of xp_cmdshell, sp_configure, Ole Automation procedures, OPENROWSET, SQL Agent job creation, or database writes made by the EPM application account that do not align with normal product behavior. On Windows, hunt for child processes spawned by SQL Server, IIS, or EPM services, especially cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl.exe, or unusual archive/executable staging. Review scheduled tasks, services, local users/groups, startup folders, web directories, temporary directories, and EPM application directories for recent unauthorized additions. Network telemetry should be checked for unexpected outbound connections from the Core server to internal workstations, domain controllers, file shares, or internet hosts shortly after suspicious requests. If exploitation is suspected, preserve volatile evidence and disk artifacts before cleanup, then perform credential rotation and broader lateral-movement hunting.

• xp_cmdshell
• sp_configure 'show advanced options'
• sp_configure 'xp_cmdshell'
• EXEC master..xp_cmdshell
• EXEC xp_cmdshell
• sp_OACreate
• sp_OAMethod
• OPENROWSET
• WAITFOR DELAY
• UNION SELECT
• information_schema
• sys.objects
• sys.databases
• ' OR '1'='1
• " OR "1"="1
• --
• /*
• %27%20OR%20%271%27%3D%271
• %55%4e%49%4f%4e%20%53%45%4c%45%43%54
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• curl.exe http
• wget.exe http
• mshta.exe http
• wscript.exe
• cscript.exe
• rundll32.exe
• schtasks.exe /create
• sc.exe create
• net user /add
• net localgroup administrators
• sqlservr.exe spawning cmd.exe
• sqlservr.exe spawning powershell.exe
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe

What your security team should do

• Treat this as an urgent remediation item because it is in CISA KEV, has active exploitation, and has an EPSS score near 1.0.
• Inventory all Ivanti EPM Core servers, including test, disaster-recovery, and legacy management servers, and confirm version and patch state.
• Apply the Ivanti fixed release or hotfix immediately; if patching must be delayed, isolate the Core server using firewall allowlists and administrative jump paths.
• Hunt for prior exploitation before and after patching, focusing on SQL injection attempts, SQL Server command-execution features, suspicious child processes, and new persistence on the Core server.
• Review SQL Server and Windows logs for evidence of xp_cmdshell, SQL Agent job abuse, PowerShell execution, encoded commands, file downloads, or new administrative accounts.
• Rotate EPM-related credentials, database credentials, service-account passwords, and any secrets stored in the platform if suspicious activity is found.
• Restrict EPM administrative access with privileged access controls, MFA where supported, and dedicated admin workstations.
• Segment managed-device communication from administrative access so unauthenticated adjacent-network access to Core server services is minimized.
• Ensure EDR coverage and tamper protection are enabled on the EPM Core server and associated database server.
• Because the CISA KEV due date was 2024-10-23, document remediation status and exceptions for governance and audit tracking.