CVE-2024-50330: Ivanti Endpoint Manager (EPM) SQL Injection to RCE

Overview

CVE-2024-50330 is a critical pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerability was disclosed and patched in the November 2024 security update.

Technical Details

• CVE: CVE-2024-50330
• CWE: CWE-89 (SQL Injection)
• CVSS: Critical (CVSS 3.x score ~9.8)
• Attack Vector: Network
• Authentication: None required
• Impact: Remote Code Execution

The flaw exists in an unauthenticated endpoint within the Ivanti EPM web interface. By injecting malicious SQL queries via crafted HTTP requests to a vulnerable parameter, an attacker can manipulate backend SQL queries against the Microsoft SQL Server database. This can be leveraged to enable xp_cmdshell and execute arbitrary operating system commands.

Affected Versions

All versions of Ivanti Endpoint Manager prior to the November 2024 security update.

Reproduction