CVE-2020-13774: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

An unrestricted file-upload issue was discovered in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1. The vulnerability allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue stems from insufficient file extension validation and insecure file operations on uploaded images, where failed operations leave temporarily created files in an accessible server location. The vulnerability was discovered in April 2020 and was assigned CVE-2020-13774 with a CVSS 3.1 score of 9.9 (Critical) (JUMPSEC Labs, NVD).

The vulnerability exists in the '/LDMS/softwaredistribution/EditLaunchPadDialog.aspx' URL which allows image file uploads to the server. The security controls for file extension validation are implemented client-side, making them easily bypassable. An attacker can craft a .ico image file containing ASP code and upload it with an .aspx extension, which can then be accessed and executed at '/landesk/files/.aspx'. To exploit this vulnerability, the user must be authenticated and either belong to the 'LANDesk Administrators' group or be part of both the 'Landesk Management Suite' group and have the 'Software Distribution' role (JUMPSEC Labs).

The vulnerability allows authenticated attackers to achieve remote code execution on the affected system. Due to its critical severity rating (CVSS 9.9), successful exploitation could lead to complete system compromise, potentially affecting the confidentiality, integrity, and availability of the server (NVD).

The vulnerability requires authentication and specific user permissions for exploitation. The attacker must either be part of the 'LANDesk Administrators' group or have both 'Landesk Management Suite' group membership and 'Software Distribution' role assignment (JUMPSEC Labs).

The vulnerability has been patched by the vendor in version 2020.1.1. The issue was also reportedly fixed in version 2019.1.4, though this was not verified by the security researchers. Users are advised to install the latest available software update to remediate the vulnerability (JUMPSEC Labs).