Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-13159 โ€” AI Deep Analysis Summary

CVSS 9.8 ยท Critical

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: Ivanti EPM has a critical **Absolute Path Traversal** flaw. <br>๐Ÿ’ฅ **Consequences**: Remote attackers can **leak sensitive info** and coerce machine credentials for relay attacks.โ€ฆ
Read full answer (login)

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: **CWE-36** (Absolute Path Traversal). <br>๐Ÿ” **Flaw**: Improper input validation in the `GetHashForWildcardRecursive` endpoint.โ€ฆ
Read full answer (login)

Q3Who is affected? (Versions/Components)

๐Ÿข **Affected**: **Ivanti Endpoint Manager (EPM)**. <br>๐Ÿ“… **Context**: Specifically impacts versions like **EPM 2024** and **EPM 2022 SU6** (based on Jan 2025 advisory).

Q4What can hackers do? (Privileges/Data)

๐Ÿ’€ **Attacker Actions**: <br>1. **Unauthenticated** access. <br>2. **Coerce** the EPM machine account credential. <br>3. Use credentials for **NTLM relay attacks**. <br>4.โ€ฆ
Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

โšก **Threshold**: **LOW**. <br>๐Ÿ”“ **Auth**: **None required** (Unauthenticated). <br>๐ŸŒ **Access**: Remote (Network). <br>๐Ÿ‘ค **UI**: No user interaction needed.

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ”ฅ **Public Exp?**: **YES**. <br>๐Ÿ“‚ **PoC**: Available on GitHub (e.g., `horizon3ai/Ivanti-EPM-Coercion-Vulnerabilities`). <br>๐Ÿ› ๏ธ **Tools**: Nuclei templates exist for automated scanning.

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check**: <br>1. Scan for **Ivanti EPM** endpoints. <br>2. Use **Nuclei** with CVE-2024-13159 template. <br>3. Look for **UNC path** injection points in `GetHashForWildcardRecursive`.

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿฉน **Official Fix**: **YES**. <br>๐Ÿ“ข **Advisory**: Ivanti released a security advisory in **Jan 2025**. <br>โœ… **Action**: Update to the latest patched version immediately.

Q9What if no patch? (Workaround)

๐Ÿšง **No Patch?**: <br>1. **Block** external access to EPM endpoints. <br>2. **Restrict** NTLM authentication protocols. <br>3. Implement **WAF rules** to block UNC path injections.

Q10Is it urgent? (Priority Suggestion)

๐Ÿšจ **Urgency**: **CRITICAL**. <br>โฑ๏ธ **Priority**: **P1**. <br>โš ๏ธ **Reason**: Unauthenticated, remote, and active PoCs exist. Immediate patching is mandatory to prevent credential coercion.

Continue exploring

Vulnerability detail Full AI analysis (login) Ivanti CWE-36