A proof-of-concept (PoC) exploit has been released for the CVE-2024-29847 vulnerability, a critical vulnerability in Ivanti Endpoint Managerthat allows remote code execution (RCE). The release of this exploit makes it even more imperative to update devices.
The vulnerability affects Ivanti Endpoint Manager before 2022 SU6 and EPM 2024.The company patched it as part of the September 2024 update, on September 10.
The vulnerability in Ivanti Endpoint Manager was discovered by researcher Sina Kheirkhah (@SinSinology), who reported it through the Zero Day Initiative (ZDI), on May 1, 2024. The same researcher has now published details on how to exploit the Ivanti vulnerability (PoC exploit). Cybercriminals can use this information to launch attacks.
See also: D-Link patches critical vulnerabilities in WiFi 6 routers
Ivanti Endpoint Manager (CVE-2024-29847)
The security issue is related to unsafe deserialization within the AgentPortal.exe executable, specifically, in the service's OnStart method, which uses the deprecated Microsoft .NET Remoting framework (for communication between remote objects).
The service registers a TCP channel with assigned ports, without security, making it possible for a remote attacker to insert malicious objects.
See also: CISA: Adds Windows vulnerability to KEV List
Kheirkhah's exploit could allow the attacker to perform file operations, such as reading or writing files on the server, including web shells that can execute arbitrary code.
Apply the update immediately!
Ivanti has released ahot patchfor EPM 2022 and 2024, with the SU6 and September 2024 updates, respectively. The company does not offer any other solutions, so applying the security update is essential.
In today's ever-evolving cyber, it's important for organizations to prioritize patching critical vulnerabilities and regularly scan their networks for weaknesses. The recent release of a PoC exploit for the Ivanti vulnerability underscores the importance of staying vigilant and taking proactive measures to protect against potential attacks.
See also: Spring Framework: Vulnerability allows access to files
By following best practices, such as regular system updates, network segmentation, monitoring for unusual activity, and security training, organizations can improve their overall security posture and mitigate the risk of exploitation. Regular vulnerability is a vital aspect of maintaining network security and maintaining compliance with industry regulations, making it an essential practice for organizations of all sizes.
Source: www.bleepingcomputer.com
