CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
Description
CVE-2024-9379 is a medium-severity SQL injection vulnerability in the admin web console of Ivanti Cloud Services Appliance (CSA) that allows a remote authenticated attacker with admin privileges to execute arbitrary SQL statements against the backend database. The flaw affects Ivanti Endpoint Manager Cloud Services Appliance versions prior to 5.0.2. With a CVSS v3.1 base score of 6.5 (MEDIUM), the vulnerability requires high privileges but enables attackers to manipulate and destroy database contents. CISA added CVE-2024-9379 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 30, 2024, and its EPSS score of 81.70% at the 99.2nd percentile indicates significant exploitation activity, particularly when chained with other Ivanti CSA vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager cloud services appliance | < 5.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CVE-2024-9379 exploits an SQL injection weakness in the Ivanti CSA admin web console where user-supplied input is incorporated into SQL queries without proper parameterization or escaping. This allows an authenticated admin user to inject arbitrary SQL statements that are executed against the backend database, enabling data extraction, modification, and deletion. SQL injection remains one of the most prevalent and dangerous web application vulnerability classes.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
Impact Analysis
The impact of CVE-2024-9379 affects Integrity (High) and Availability (High) but notably does not impact Confidentiality (C:N). This unusual impact profile suggests the SQL injection can modify and delete database records but the attack mechanism does not directly enable data extraction through the vulnerable endpoint. The attack is network-accessible (AV:N) with low complexity (AC:L), requires high privileges (PR:H) corresponding to admin access, and no user interaction (UI:N). The Ivanti CSA database contains critical configuration data for endpoint management, including device enrollments, policies, certificates, and management settings. An attacker exploiting this SQL injection can corrupt or delete this data, disrupting endpoint management operations across the enterprise. The EPSS score of 81.70% at the 99.2nd percentile is unusually high for a medium-severity vulnerability, reflecting the fact that CVE-2024-9379 is actively chained with other vulnerabilities including CVE-2024-8963 (authentication bypass) and CVE-2024-9380 (command injection) in coordinated attack campaigns. While the ransomware nexus is listed as Unknown, the disruption of endpoint management infrastructure can significantly amplify the impact of concurrent attacks.
Exploit Maturity
CVE-2024-9379 has high exploit maturity driven by its role in chained attack campaigns against Ivanti CSA. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 30, 2024. The EPSS score of 81.70% at the 99.2nd percentile reflects significant exploitation activity. Ivanti documented this vulnerability alongside related CSA flaws in their security advisory. While SQL injection with admin-only access might seem limited in isolation, threat actors have demonstrated effective exploitation by chaining CVE-2024-9379 with CVE-2024-8963 (path traversal for admin access bypass) and CVE-2024-9380 (OS command injection). In this chain, the SQL injection is used to manipulate database entries that facilitate further exploitation, such as modifying authentication records or injecting data that triggers other vulnerabilities.
Remediation
-
Upgrade Ivanti Cloud Services Appliance to version 5.0.2 or later immediately as documented in the Ivanti security advisory. This update patches CVE-2024-9379 along with related vulnerabilities CVE-2024-9380 and CVE-2024-9381.
-
Restrict admin console access to the CSA appliance by implementing network-level access controls that limit web console connectivity to specific management workstations and networks. Block all direct internet exposure of the admin interface.
-
Verify database integrity by comparing the CSA database contents against known-good backups or expected state. Check for unauthorized modifications to device enrollments, admin accounts, policies, and certificates that could indicate exploitation.
-
Monitor database activity logs on the CSA appliance for indicators of SQL injection including unusual query patterns, bulk data modifications, error messages indicating SQL syntax issues, and database operations outside normal application behavior.
-
Implement defense-in-depth measures including a web application firewall (WAF) in front of the CSA admin console to detect and block SQL injection payloads, database activity monitoring for anomalous queries, and multi-factor authentication for all admin access to reduce the risk of credential compromise.
Technical Details
CVE-2024-9379 is an SQL injection vulnerability in the Ivanti Cloud Services Appliance admin web console. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring high privileges (PR:H) and no user interaction (UI:N), with Unchanged scope (S:U), no confidentiality impact (C:N), and high impact on integrity and availability. The absence of confidentiality impact (C:N) is noteworthy for an SQL injection vulnerability, suggesting that the injection point does not return query results to the attacker (a "blind" SQL injection scenario) or that the data accessible through the injection does not contain confidential information. The high integrity impact (I:H) indicates the attacker can modify arbitrary database records, while the high availability impact (A:H) suggests the ability to delete or corrupt data to the point of service disruption. The vulnerability exists in an admin console input field where user-supplied values are concatenated into SQL queries without proper parameterization. An authenticated admin can inject SQL metacharacters to modify the query logic, executing arbitrary SQL statements against the backend database. This includes UPDATE, DELETE, and potentially INSERT operations that can corrupt the CSA configuration database, modify device management policies, or create backdoor admin accounts.
Frequently Asked Questions
Is CVE-2024-9379 being actively exploited?
Yes, CISA confirmed active exploitation and added CVE-2024-9379 to the Known Exploited Vulnerabilities catalog. The vulnerability is being exploited in chained attacks with CVE-2024-8963 and CVE-2024-9380 against Ivanti CSA deployments, as reflected by the EPSS score of 81.70% at the 99.2nd percentile.
What products are affected by CVE-2024-9379?
Ivanti Endpoint Manager Cloud Services Appliance (CSA) versions before 5.0.2 are affected. All CSA deployments that have not been updated to the patched version are vulnerable to this SQL injection attack.
How do I fix CVE-2024-9379?
Upgrade the Ivanti CSA to version 5.0.2 or later. Restrict admin console access to authorized networks, verify database integrity, and implement multi-factor authentication for admin accounts.
Why does CVE-2024-9379 have such high exploitation despite being only medium severity?
While CVE-2024-9379 is rated MEDIUM (6.5) individually, its exploitation rate is driven by its role in a vulnerability chain. Attackers combine it with CVE-2024-8963 (authentication bypass) and CVE-2024-9380 (OS command injection) to achieve unauthenticated remote code execution on Ivanti CSA appliances. The SQL injection component is used to manipulate database state that facilitates the broader attack.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.