CVE-2024-34781

What it actually does

This vulnerability is an authenticated SQL injection flaw in Ivanti Endpoint Manager. A remote attacker who already has administrator-level access to the application can inject malicious SQL into vulnerable server-side database operations. Because Endpoint Manager is tightly coupled with backend database and management workflows, successful exploitation can progress beyond data manipulation to remote code execution on the application or management server, depending on database privileges, stored procedure exposure, service account permissions, and application architecture.

Why it matters to the business

Ivanti Endpoint Manager is commonly used to administer endpoints, deploy software, run management tasks, and maintain operational visibility across fleets. If compromised, an attacker with admin access could turn the management platform into a control point for broader intrusion activity, including unauthorized software deployment, credential access, data theft, endpoint tampering, or disruption of IT operations. Although exploitation requires prior administrative authentication, the EPSS score indicates a meaningful likelihood of exploitation activity, so exposed or internet-reachable management consoles should be treated as high-priority remediation targets.

How an attack unfolds

An attacker first obtains valid administrator credentials for Ivanti Endpoint Manager through phishing, credential theft, password reuse, prior compromise, or abuse of an existing privileged account. After authenticating to the management interface, the attacker sends crafted requests containing SQL injection payloads to vulnerable functionality. The injected SQL is executed by the backend database in the context of the application’s database account. From there, the attacker may read or modify database contents, alter application state, create persistence, abuse database features or stored procedures, and, where permissions allow, pivot from SQL execution into operating-system command execution. Successful exploitation can result in remote code execution on infrastructure that is trusted to manage enterprise endpoints.

How to fix it

Apply the vendor security update that fixes the issue: Ivanti Endpoint Manager 2024 November Security Update or later, or Ivanti Endpoint Manager 2022 SU6 November Security Update or later. If immediate patching is not possible, restrict access to the Endpoint Manager console and related APIs to trusted administrative networks or VPNs, enforce multifactor authentication for all administrator accounts, review and reduce administrator privileges, disable or limit unnecessary database features that enable operating-system command execution, and monitor closely for suspicious authenticated administrative activity. Rotate credentials for privileged application, database, and service accounts if compromise is suspected.

How to confirm the fix worked

Confirm the installed Ivanti Endpoint Manager build includes the 2024 November Security Update or, for the 2022 branch, 2022 SU6 November Security Update or later. Validate through the product administration interface, server file versions, vendor update inventory, or configuration management records. Confirm the management interface is not broadly exposed to the internet and that only authorized administrative networks can reach it. Review administrator accounts, recent privilege changes, and database permissions. Where permitted, use an authenticated vulnerability scanner or vendor-supported health check to verify the SQL injection issue is no longer present.

Typical attack path

1. Obtain or compromise an administrator-level Ivanti Endpoint Manager account.
2. Authenticate remotely to the Ivanti Endpoint Manager interface or API.
3. Identify vulnerable functionality that passes attacker-controlled input into backend SQL queries.
4. Submit crafted SQL injection payloads through authenticated requests.
5. Use injected SQL to enumerate database permissions, application configuration, credentials, and management data.
6. Escalate from database execution to command execution where database and service account permissions allow.
7. Deploy persistence, tamper with endpoint management settings, or use the platform to affect managed systems.

How to detect it

Investigate whether exploitation has already occurred by correlating Ivanti Endpoint Manager application logs, web access logs, authentication logs, Windows Event Logs, database audit logs, and endpoint deployment/task history. Focus on successful administrator logins followed by unusual request patterns, SQL syntax in parameters, database errors, unexpected configuration changes, new administrator accounts, altered roles, new scheduled jobs, suspicious stored procedure execution, or command execution spawned from database or application service processes. Review IIS or web server logs for encoded SQL keywords, comment markers, stacked queries, time-delay functions, and UNION-based probes. On the database server, look for anomalous queries, failed SQL parsing, use of dangerous procedures, new SQL Agent jobs, or access to sensitive application tables outside normal workflows. On the application server, examine process creation events for shells or scripting interpreters launched by web, application, database, or service account processes. Also review Endpoint Manager task and deployment history for unauthorized package pushes, scripts, remote-control activity, or endpoint configuration changes around suspicious admin sessions.

• UNION SELECT
• UNION ALL SELECT
• WAITFOR DELAY
• SLEEP(
• BENCHMARK(
• xp_cmdshell
• sp_oacreate
• sp_configure
• EXEC master..xp_cmdshell
• ';--
• ' OR '1'='1
• " OR "1"="1
• INFORMATION_SCHEMA
• sys.objects
• sqlmap
• Process created: cmd.exe
• Process created: powershell.exe
• Process created: wscript.exe
• Process created: cscript.exe
• Process created: rundll32.exe
• cmd.exe /c
• powershell -enc
• powershell.exe -EncodedCommand
• /bin/sh -c

What your security team should do

• Patch Ivanti Endpoint Manager to the applicable November 2024 security update or later as the top priority.
• Immediately restrict network access to the Endpoint Manager console and APIs to trusted administrative sources only.
• Audit all administrator accounts for unexpected users, stale accounts, weak authentication, or recent suspicious logins.
• Enable or enforce multifactor authentication for privileged Endpoint Manager access.
• Review Endpoint Manager, web server, application, and database logs for suspicious authenticated requests containing SQL injection patterns.
• Check for unusual database activity, new jobs, stored procedure abuse, command execution, or unexpected changes to management configuration.
• Rotate privileged credentials if there is any evidence of exploitation or unexplained administrative activity.
• Hunt across managed endpoints for unexpected deployments, scripts, remote tasks, or policy changes originating from the management server.