CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
Description
CVE-2024-29824 is a high-severity SQL injection vulnerability in the Core server component of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior versions, the enterprise endpoint management platform used to deploy, configure, and secure devices across organizational networks. An unauthenticated attacker on the same network can exploit this flaw to execute arbitrary code on the EPM Core server through crafted SQL queries. With a CVSS v3.1 base score of 8.8 and an adjacent network attack vector, the vulnerability requires no privileges and no user interaction, making it highly exploitable within enterprise LAN environments. CISA has added CVE-2024-29824 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 23, 2024, and the EPSS score of 93.98% at the 99.9th percentile confirms massive exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager | < 2022; 2022 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://forums.ivanti.com/s/article/Security-Advisory-May-2024(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29824(US Government Resource)
Weakness Type
SQL Injection Leading to Remote Code Execution
CVE-2024-29824 is an SQL injection vulnerability in the Core server of Ivanti Endpoint Manager that enables remote code execution. SQL injection occurs when an application incorporates untrusted input into SQL database queries without proper parameterization or sanitization, allowing an attacker to manipulate the query logic. In this case, the vulnerability goes beyond simple data extraction because the underlying database server supports extended stored procedures or command execution features that allow the injected SQL statements to execute operating system commands. The EPM Core server exposes a network-accessible interface that processes requests containing user-controlled parameters, and insufficient input validation allows an unauthenticated attacker on the adjacent network to inject malicious SQL that escalates from database manipulation to full system command execution.
Impact Analysis
Confidentiality is fully compromised when CVE-2024-29824 is exploited. The Ivanti EPM Core server stores and manages endpoint configurations, deployment packages, security policies, and credentials for all managed devices across the enterprise. SQL injection into this system exposes the entire endpoint management database, including device inventories, software deployment credentials, and potentially stored authentication tokens for managed endpoints.
Integrity faces maximum impact because the SQL injection enables arbitrary code execution on the Core server, allowing the attacker to modify endpoint management policies, push malicious software packages to managed devices, alter security configurations, and install persistent backdoors. Compromising the EPM server is particularly devastating because it serves as the central command-and-control platform for enterprise endpoint management, giving the attacker the ability to weaponize legitimate management infrastructure.
Availability is also fully impacted, as the attacker can disrupt endpoint management services, corrupt the management database, or use the compromised server to push destructive payloads to all managed endpoints simultaneously. The adjacent network attack vector (AV:A) means the attacker must be on the same network segment as the EPM Core server, but in many enterprise environments, this is achievable through VPN access, compromised workstations, or Wi-Fi access. The EPSS score of 93.98% at the 99.9th percentile is extraordinarily high, indicating this is one of the most exploited vulnerabilities currently tracked. While ransomware association is listed as unknown, compromising an endpoint management server provides the ideal distribution mechanism for ransomware across an entire enterprise.
Exploit Maturity
CVE-2024-29824 exhibits the highest level of exploit maturity with confirmed widespread active exploitation. Its presence in CISA's Known Exploited Vulnerabilities catalog with a deadline of October 23, 2024, combined with an EPSS score of 93.98% at the 99.9th percentile, places it among the most actively exploited vulnerabilities in enterprise infrastructure.
Ivanti has published a security advisory through their support forums documenting the vulnerability and providing patch information. The SQL injection to code execution attack chain is a well-understood exploitation technique, and the unauthenticated nature of the vulnerability (PR:N) with no user interaction required (UI:N) makes it immediately exploitable once an attacker has network adjacency to the EPM Core server. The adjacent network requirement (AV:A) provides some mitigation compared to internet-facing vulnerabilities, but enterprise network segmentation is frequently insufficient to prevent lateral movement to management network segments. While the ransomware link is listed as unknown, endpoint management platforms are the most impactful targets for ransomware operators because they provide built-in mechanisms to deploy software to every managed device in the organization simultaneously.
Remediation
-
Patch Ivanti Endpoint Manager immediately. Apply the security update referenced in Ivanti's May 2024 Security Advisory. Upgrade from EPM 2022 SU5 or earlier to the patched version that addresses the SQL injection vulnerability in the Core server.
-
Isolate the EPM Core server on a dedicated management network. Ensure the Ivanti EPM Core server resides on a restricted network segment accessible only to authorized administrator workstations and managed endpoints that require direct communication. Implement strict firewall rules preventing access from general user VLANs, guest networks, and other non-essential network segments.
-
Audit EPM Core server for indicators of compromise. Examine database logs for unusual SQL query patterns, check the operating system for unauthorized processes or scheduled tasks, review file system integrity for unexpected modifications, and inspect network connections for suspicious outbound traffic. Pay special attention to any signs that endpoint management policies or deployment packages have been tampered with.
-
Rotate all credentials stored in or managed by EPM. After patching, change all administrative passwords, service account credentials, database connection strings, and any deployment credentials stored within the EPM platform. If the server was compromised, attackers may have extracted credentials that enable persistent access to managed endpoints.
-
Implement database activity monitoring. Deploy database audit logging and real-time monitoring on the EPM Core server's database to detect SQL injection attempts and unusual query patterns. Configure alerts for queries containing command execution functions, extended stored procedures, or data exfiltration patterns targeting the endpoint management database.
Technical Details
CVE-2024-29824 carries a CVSS v3.1 vector of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 8.8 (High). The adjacent network attack vector (AV:A) means the attacker must be on the same network segment or have layer-2 adjacency to the EPM Core server, which is lower than a network vector but still highly exploitable in enterprise environments. Low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N) make this immediately exploitable once network adjacency is achieved.
The vulnerability exists in the Core server component of Ivanti Endpoint Manager, which provides the central management interface and database backend for the EPM platform. The Core server exposes network-accessible services that accept requests from managed endpoints and administrative consoles. An input validation flaw in one of these services allows an unauthenticated attacker to inject malicious SQL statements into database queries executed by the Core server. The SQL injection is not limited to data extraction; because the underlying database engine supports command execution capabilities (such as Microsoft SQL Server's xp_cmdshell or similar extended stored procedures), the attacker can escalate from SQL injection to operating system command execution.
All three impact metrics are rated high (C:H/I:H/A:H), reflecting the complete compromise potential when arbitrary code execution is achieved on the EPM Core server. The scope is unchanged (S:U), meaning the direct vulnerability impact is confined to the EPM server, but the practical consequences extend to every managed endpoint because the EPM platform is designed to push configurations, software, and commands to all devices under its management. Affected versions include Ivanti EPM 2022 SU5 and all prior releases of the 2022 branch.
Frequently Asked Questions
What is CVE-2024-29824?
CVE-2024-29824 is a SQL injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier that allows an unauthenticated attacker on the same network to execute arbitrary code on the server. With a CVSS score of 8.8 and active exploitation confirmed, it represents a critical threat to enterprise endpoint management infrastructure.
Why is an adjacent network vulnerability rated so highly?
While the adjacent network requirement (AV:A) limits the attack to the same network segment, the combination of no authentication required, no user interaction needed, and arbitrary code execution on a central management server makes this extremely impactful. Endpoint management servers control software deployment and configuration for every managed device, making them the highest-value targets within enterprise networks.
Can this vulnerability be exploited from the internet?
Not directly. The CVSS adjacent network vector means the attacker must be on the same network segment as the EPM Core server. However, attackers commonly achieve network adjacency through VPN access, compromised workstations, or by pivoting through other vulnerabilities to reach the management network. Organizations should not rely solely on network boundaries for protection.
What should I do if my EPM server may have been compromised?
Conduct a full forensic investigation of the EPM Core server, including database query logs, process listings, file system integrity, and network connections. Critically, verify that no endpoint management policies or deployment packages have been modified to push malicious software to managed devices. Rotate all credentials and rebuild the server from known-good media if compromise is confirmed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.