CVE-2024-29827

What it actually does

This is a critical unauthenticated SQL injection affecting the Core server component of Ivanti Endpoint Manager 2022 SU5 and earlier, exploitable by an attacker with network adjacency to the server. Improper handling of attacker-controlled input allows SQL commands to be injected into backend database queries. Because the vulnerable path can be reached without authentication and the server/database context is highly privileged, successful exploitation can lead to arbitrary code execution, database disclosure or modification, privilege escalation within the application, and potential compromise of the underlying Core server. The supplied product metadata also lists misp/misp GIT with a fixed commit of dc73287ee2000476e3a5800ded402825ca10f7e8; organizations should reconcile this discrepancy during asset validation and ensure all products matching the vulnerable inventory are remediated.

Why it matters to the business

A successful attacker can take control of a central endpoint-management server, which is operationally high impact because such systems often manage software deployment, configuration, inventory, and administrative workflows across many endpoints. Compromise could result in theft of sensitive endpoint data, unauthorized changes to managed devices, service disruption, or use of the management server as a launch point for broader internal compromise. The vulnerability has a high CVSS score and a high EPSS probability, and it has been public for a long time, so unpatched systems should be treated as urgent even though it is not currently listed in CISA KEV and no ransomware use is indicated in the provided data.

How an attack unfolds

An attacker first gains network reachability to the Core server, such as from the same internal network segment, a VPN foothold, a compromised workstation, or another adjacent system. The attacker identifies the exposed application service and sends crafted unauthenticated requests containing SQL syntax in parameters processed by the Core server. The vulnerable server incorporates that input into SQL queries without adequate parameterization, causing the database to execute attacker-controlled statements. Depending on database permissions and server configuration, the attacker may enumerate schema and users, extract sensitive data, alter application records, create or modify administrative access, or invoke database features that lead to command execution on the Core server. After gaining execution or administrative control, the attacker can deploy persistence, access management functions, move laterally, tamper with logs, and use the trusted management server to affect downstream endpoints.

How to fix it

Upgrade Ivanti Endpoint Manager to a version later than 2022 SU5 that contains the vendor fix for this SQL injection. If any repositories or deployments match the supplied affected package metadata for misp/misp GIT, update to a revision containing commit dc73287ee2000476e3a5800ded402825ca10f7e8 or later, and verify the advisory source because the product metadata appears inconsistent with the vulnerability description. Until patching is complete, restrict access to the Core server to only required administrative networks, block unauthenticated access from user subnets, enforce VPN and firewall segmentation, monitor database activity, and disable or tightly restrict high-risk database features that allow command execution. Rotate application, database, and service credentials if exploitation is suspected, and review any newly created administrative accounts or configuration changes.

How to confirm the fix worked

Confirm the installed Ivanti EPM Core server version is newer than 2022 SU5 or explicitly includes the vendor fix. For any GIT-based deployments identified by inventory, confirm the deployed revision includes dc73287ee2000476e3a5800ded402825ca10f7e8 or a later commit. Validate network controls by confirming the Core server is not reachable from untrusted internal segments or unauthenticated user networks. Run authenticated vulnerability scanning or vendor-provided checks where available, and perform a controlled web/API request review to ensure SQL metacharacters are rejected or safely parameterized rather than producing database errors or timing anomalies. Review application and database logs after remediation to ensure no continuing SQL errors, anomalous requests, or unexpected administrative changes are present.

Typical attack path

1. Obtain network adjacency to the vulnerable Core server through internal access, VPN, compromised host, or lateral movement.
2. Discover the management server and identify reachable application or API services.
3. Send unauthenticated requests containing SQL metacharacters or time/error-based SQL injection probes.
4. Confirm injection through database errors, timing differences, changed responses, or successful query manipulation.
5. Enumerate database structure, application users, roles, secrets, and configuration data.
6. Use database privileges to modify application state, create administrative access, or execute operating-system commands where supported.
7. Establish persistence on the server or within the application configuration.
8. Use the compromised management server to collect data, disrupt operations, or pivot to managed endpoints.

How to detect it

Look for evidence of unauthenticated SQL injection probing and post-exploitation on the Core server and its database. Relevant log sources include web/application access logs, Ivanti EPM Core server logs, reverse proxy logs, Windows Event Logs, database audit logs, SQL Server error logs, EDR telemetry, process creation logs, authentication logs, and change/audit records for administrative users or server configuration. Search for requests containing SQL metacharacters, boolean-based probes, UNION queries, stacked statements, comments, sleep or delay functions, and database error responses. In database logs, look for unexpected ad hoc queries, enumeration of system tables, creation of users or roles, use of command-execution stored procedures, or attempts to enable advanced database features. On the server, investigate unexpected child processes spawned by database or web service processes, especially command shells, scripting interpreters, file download utilities, or encoded PowerShell. Also review for unusual administrative account creation, endpoint deployment jobs, scheduled tasks, service creation, suspicious files in temporary directories, and log clearing after suspicious requests. No named threat actors or KEV exploitation status were provided, so detection should focus on behavior and artifacts rather than actor-specific tooling.

• UNION SELECT
• UNION ALL SELECT
• OR 1=1
• ' OR '1'='1
• " OR "1"="1
• WAITFOR DELAY
• SLEEP(
• BENCHMARK(
• pg_sleep(
• information_schema
• sys.objects
• sys.tables
• xp_cmdshell
• sp_configure
• enable_xp_cmdshell
• Incorrect syntax near
• Unclosed quotation mark after the character string
• SQL syntax; check the manual that corresponds to your
• Microsoft OLE DB Provider for SQL Server
• ODBC SQL Server Driver
• System.Data.SqlClient.SqlException
• cmd.exe /c
• powershell.exe -EncodedCommand
• powershell.exe -enc
• wscript.exe
• cscript.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• rundll32.exe
• regsvr32.exe
• schtasks /Create
• wevtutil cl
• Event ID 4688
• Event ID 7045

What your security team should do

• Immediately inventory Ivanti EPM Core servers and verify whether any are running 2022 SU5 or earlier.
• Prioritize patching or upgrading because the vulnerability is unauthenticated, high severity, network-adjacent, and has a high EPSS score.
• Restrict Core server access to dedicated administrative networks and block access from general workstation, guest, and VPN pools unless explicitly required.
• If patching cannot be completed quickly, add compensating controls such as firewall ACLs, WAF or reverse-proxy filtering, database monitoring, and heightened logging.
• Hunt for prior exploitation across application, web, database, endpoint, and authentication logs using SQL injection patterns, database error messages, suspicious process launches, and unexpected admin changes.
• Review application users, service accounts, scheduled tasks, startup items, and recently modified configuration files for persistence.
• Rotate database, application, and service credentials if there is any sign of exploitation or if logs are incomplete.
• Reconcile the conflicting product metadata in vulnerability management tooling so Ivanti EPM and any listed misp/misp GIT assets are not incorrectly excluded from remediation workflows.