CVE-2024-29825: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

An unspecified SQL Injection vulnerability (CVE-2024-29825) was identified in the Core server of Ivanti Endpoint Manager (EPM) 2022 Service Update 5 (SU5) and prior versions. The vulnerability was discovered and reported through HackerOne on March 20, 2024, and was publicly disclosed on May 31, 2024. This security flaw affects all installations of Ivanti EPM up to and including version 2022 SU5 (NVD, ZDI).

The vulnerability specifically exists within the implementation of the RecordBrokenApp method. The core issue stems from inadequate validation of user-supplied strings before their use in SQL query construction. The vulnerability has received a Critical severity rating with a CVSS v3.1 base score of 8.8 (High) according to NVD, and 9.6 (Critical) according to HackerOne. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (ZDI, NVD).

The successful exploitation of this vulnerability allows an unauthenticated attacker within the same network to execute arbitrary code on the affected system. An attacker can leverage this vulnerability to execute code in the context of the service account, potentially leading to complete system takeover, data breaches, and significant operational disruptions (SecurityOnline, ZDI).

The vulnerability can be exploited by an unauthenticated attacker who has network access to the target system. No user interaction is required for exploitation. As of the latest reports, there have been no known instances of this vulnerability being exploited in the wild (ZDI).

Ivanti has released a security update to address this vulnerability. Organizations using affected versions of Ivanti EPM are strongly urged to apply the latest patches as soon as possible. The vulnerability affects all versions of Ivanti EPM 2022 prior to Service Update 5 (SecurityOnline, ZDI).