Description
该漏洞是数据库Ivanti Endpoint Manager Mobile使用了Orm框架Hibernate验证器中允许模板字符串${}占位符，且没有对它进行转义或清理。在运行时，Hibernate 可能会通过 Spring 的StandardELContext 处理模板以解析 ${...} 等占位符，从而无意中执行攻击者嵌入的任何表达式。
Ivanti Endpoint Manager Mobile （EPMM）存在远程代码执行漏洞（CVE-2025-4427、CVE-2025-4428）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
https://www.tenable.com/blog/cve-2025-4427-cve-2025-4428-ivanti-endpoint-manager-mobile-epmm-remote-code-execution
https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability
https://www.ionix.io/threat-center/cve-2025-4428/
https://nvd.nist.gov/vuln/detail/CVE-2025-4427
https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/
https://www.rapid7.com/blog/post/2025/05/16/etr-ivanti-epmm-exploit-chain-exploited-in-the-wild/
https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428
https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428
https://thehackernews.com/2025/05/ivanti-patches-epmm-vulnerabilities.html