CVE-2024-37397

What it actually does

CVE-2024-37397 is an unauthenticated XML External Entity (XXE) vulnerability in the Ivanti Endpoint Manager (EPM) provisioning web service. If the service processes attacker-supplied XML with external entity resolution enabled, a remote attacker can cause the server to read local resources or resolve attacker-controlled external entities. The disclosed impact is leakage of API secrets, which can enable follow-on authenticated access to EPM APIs or other administrative workflows if those secrets are valid and reusable.

Why it matters to the business

Successful exploitation can expose sensitive API secrets from Ivanti EPM, potentially allowing attackers to impersonate trusted integrations, access endpoint-management functions, and progress toward broader compromise of managed systems. Because EPM is used to administer endpoints, leakage of secrets from this platform can have disproportionate operational impact, including unauthorized configuration changes, software deployment abuse, data exposure, and incident response disruption. The EPSS score is elevated, indicating meaningful likelihood of exploitation in the wild even though this issue is not currently listed in CISA KEV and no ransomware association is reported.

How an attack unfolds

An attacker identifies an internet-facing or otherwise reachable Ivanti EPM provisioning web service running a vulnerable version before EPM 2022 SU6 or before the 2024 September update. The attacker sends a crafted XML payload to the provisioning endpoint that defines an external entity referencing a local file, internal resource, or attacker-controlled listener. Because the XML parser resolves the external entity, the EPM server reads or attempts to fetch the referenced resource. The attacker uses the response body, error behavior, or out-of-band callback to extract sensitive material, specifically API secrets. Those secrets may then be used to call EPM APIs, impersonate trusted services, enumerate managed assets, or stage additional actions through the endpoint-management platform.

How to fix it

Upgrade Ivanti EPM to a fixed release: Ivanti EPM 2022 SU6 or later, or apply the Ivanti EPM 2024 September update or later. After patching, rotate any API secrets, integration tokens, service credentials, and provisioning-related secrets that may have been accessible to the EPM service, because patching does not invalidate secrets already disclosed. If immediate patching is not possible, restrict access to the provisioning web service to trusted management networks or VPNs, block direct internet exposure, enforce network-layer allowlisting, and monitor or temporarily disable vulnerable provisioning functionality where operationally feasible. Confirm XML parsing configurations disable DTDs and external entity resolution wherever configurable, although vendor patching should be treated as the authoritative fix.

How to confirm the fix worked

Verify the installed Ivanti EPM version is 2022 SU6 or later, or has the 2024 September update or later applied. Confirm the provisioning web service is not reachable from untrusted networks unless explicitly required and protected by compensating controls. Use authenticated version checks, vendor patch inventory, and configuration management data to confirm all EPM servers and standby nodes are updated. Where safe and authorized, perform a controlled XXE validation using a benign external entity payload that should not be resolved; patched systems should reject the payload or process it without outbound DNS/HTTP callbacks and without returning local file contents. Review secret rotation records to ensure exposed API secrets and related integration credentials were replaced after remediation.

Typical attack path

1. Discover exposed Ivanti EPM provisioning web service instances through scanning, asset inventory leakage, or targeted reconnaissance.
2. Confirm the service is running a vulnerable release prior to Ivanti EPM 2022 SU6 or prior to the 2024 September update.
3. Send crafted XML containing an external entity declaration to the provisioning web service.
4. Force the server-side XML parser to resolve local or remote entities.
5. Extract API secrets through the HTTP response, parser error messages, or out-of-band DNS/HTTP callbacks.
6. Use leaked secrets to authenticate to EPM APIs or supporting services.
7. Perform follow-on reconnaissance, privilege abuse, endpoint-management actions, or persistence depending on the permissions associated with the exposed secret.

How to detect it

To determine whether exploitation already occurred, review Ivanti EPM web/provisioning service access logs, reverse-proxy logs, WAF logs, EDR network telemetry, and DNS logs for suspicious XML submissions and outbound callbacks. Focus on requests to provisioning web service endpoints containing XML document type declarations or entity definitions, especially requests from unauthenticated external IP addresses. Look for payload fragments such as "<!DOCTYPE", "<!ENTITY", "SYSTEM", "PUBLIC", "file://", "http://", "https://", or attempts to reference local files such as Windows configuration files. Check outbound DNS and HTTP traffic from EPM servers to unfamiliar domains immediately following inbound provisioning requests, which may indicate blind XXE exfiltration. Investigate EPM API audit logs for authentication using API secrets from unusual source IPs, abnormal timing, unexpected administrative API calls, mass enumeration, policy changes, software deployment activity, or new credentials/tokens created after suspicious XML requests. If historical logs are limited, treat exposed unpatched systems as potentially compromised and rotate secrets.

• <!DOCTYPE
• <!ENTITY
• SYSTEM
• PUBLIC
• file://
• expect://
• php://
• gopher://
• jar://
• http://169.254.169.254
• https://169.254.169.254
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• /windows/win.ini
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• Provisioning
• DOCTYPE.*ENTITY
• ENTITY.*SYSTEM
• ENTITY.*file://

What your security team should do

• Prioritize patching all Ivanti EPM servers to 2022 SU6 or the 2024 September update or later due to the high CVSS score and elevated EPSS likelihood.
• Immediately inventory all externally reachable Ivanti EPM provisioning web services and remove direct internet exposure where possible.
• Rotate EPM API secrets, provisioning credentials, integration tokens, and service account credentials after patching.
• Review access logs and outbound DNS/HTTP telemetry for signs of XXE probing or out-of-band entity resolution around the publication date and later.
• Add WAF or reverse-proxy rules to alert on XML payloads containing DOCTYPE, ENTITY, SYSTEM, PUBLIC, or file URI patterns sent to EPM provisioning endpoints.
• Hunt for unusual API activity using EPM secrets, including new sessions, unexpected administrative actions, endpoint package deployments, policy changes, or asset enumeration.
• Ensure EPM service accounts use least privilege and that API secrets are scoped, monitored, and rotated on a defined schedule.