CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Description
CVE-2024-13161 is a critical absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote unauthenticated attacker to access arbitrary files and leak sensitive information from the server. The flaw exists in the file handling logic of the EPM management interface, where insufficient validation of file paths enables directory traversal attacks. With a CVSS v3.1 score of 9.8 and CRITICAL severity, the vulnerability requires no authentication or user interaction to exploit. CISA has confirmed active exploitation by adding CVE-2024-13161 to the KEV catalog with a deadline of 2025-03-31, and its EPSS score of 91.64% at the 99.7th percentile places it among the most exploited vulnerabilities globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager | < 2022; 2022; 2024 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13161(US Government Resource)
- https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/(Exploit, Third Party Advisory)
Weakness Type
CWE-36: Absolute Path Traversal
CVE-2024-13161 is classified under CWE-36 (Absolute Path Traversal), which occurs when user-supplied input containing absolute file paths is used to access files without proper validation. In Ivanti Endpoint Manager, the application fails to validate or restrict file path parameters, allowing a remote attacker to specify arbitrary absolute paths and read any file accessible to the web application process.
Learn more: CWE-36 — Absolute Path Traversal
Impact Analysis
The impact of CVE-2024-13161 is critical, with the highest possible severity across all CIA triad dimensions. The vulnerability is remotely exploitable (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): An unauthenticated attacker can read any file on the EPM server, including configuration files containing database credentials, service account passwords, agent deployment keys, and managed endpoint data. Given that Ivanti EPM manages thousands of endpoints in enterprise environments, the breadth of exposed data is enormous. Integrity (High): Access to credential material enables lateral movement across the managed infrastructure. Availability (High): Compromise of the EPM server can disrupt endpoint management for the entire organization. With a CVSS score of 9.8 (CRITICAL) and an EPSS score of 91.64% at the 99.7th percentile, this is one of the most exploited vulnerabilities currently tracked.
Exploit Maturity
CVE-2024-13161 demonstrates very high exploit maturity with confirmed active exploitation and publicly available exploit code. CISA has added this vulnerability to the KEV catalog, confirming real-world exploitation against Ivanti EPM installations. The EPSS score of 91.64% at the 99.7th percentile places it among the top 0.4% of all vulnerabilities by exploitation probability. Public exploit research is available via Horizon3.ai, which provides detailed technical analysis of the credential coercion attack chain. The ransomware association is classified as unknown, but the critical severity and ability to exfiltrate credentials without authentication make this vulnerability extremely attractive to both APT groups and ransomware operators targeting enterprise management infrastructure.
Remediation
-
Apply the January 2025 Security Update for Ivanti EPM immediately. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Install the 2024 January-2025 Security Update or the 2022 SU6 January-2025 Security Update as detailed in the Ivanti Security Advisory.
-
Restrict network access to the EPM server by implementing firewall rules that limit management interface access to authorized administrator IP ranges only. The EPM server should never be directly accessible from the internet or from untrusted network segments.
-
Audit the EPM server for compromise indicators including unauthorized file access in web server logs, credential usage from unexpected sources, and configuration changes to managed endpoints. Given the credential coercion nature of the attack, rotate all credentials stored on or accessible through the EPM server.
-
Rotate all service account credentials associated with Ivanti EPM, including database credentials, LDAP bind accounts, agent communication keys, and any API tokens. The path traversal can expose these credentials to unauthenticated attackers.
-
Implement file integrity monitoring on the EPM server to detect unauthorized file access attempts, and deploy web application firewall rules to block path traversal patterns in HTTP requests targeting the EPM management interface.
Technical Details
CVE-2024-13161 is an absolute path traversal vulnerability (CWE-36) in Ivanti Endpoint Manager with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in the EPM management interface where user-supplied file path parameters are passed to file system operations without adequate validation or sanitization. An unauthenticated remote attacker can submit HTTP requests containing absolute file paths (e.g., C:\Windows\System32\config\SAM) that cause the EPM server to read and return the contents of arbitrary files on the server's file system. The Horizon3.ai research describes this as a credential coercion vulnerability, where the path traversal can be leveraged to force the EPM server to authenticate to attacker-controlled SMB shares, capturing NTLM hashes that can be relayed or cracked. The network vector (AV:N) with no authentication (PR:N), low complexity (AC:L), and no user interaction (UI:N) creates a trivially exploitable attack surface. The maximum impact across all CIA dimensions (C:H/I:H/A:H) with a score of 9.8 reflects the severity of unauthenticated arbitrary file read on a system that manages enterprise endpoints.
Frequently Asked Questions
Is CVE-2024-13161 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2024-13161 to the KEV catalog. The EPSS score of 91.64% at the 99.7th percentile places it among the most actively exploited vulnerabilities globally. Public exploit research from Horizon3.ai is available.
What products are affected by CVE-2024-13161?
Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update are affected. This includes EPM 2024 and EPM 2022 installations that have not applied the January 2025 patch.
How do I fix CVE-2024-13161?
Apply the January 2025 Security Update from Ivanti immediately. Restrict network access to the EPM management interface, rotate all credentials stored on the EPM server, and conduct forensic analysis for signs of prior exploitation.
How severe is CVE-2024-13161?
CVE-2024-13161 has a CVSS score of 9.8 (CRITICAL) with unauthenticated remote exploitation capability. The path traversal enables arbitrary file read and credential coercion, making it one of the most dangerous vulnerabilities in enterprise endpoint management.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.