Security engineers have identified four critical vulnerabilities in Ivanti Endpoint Manager, each rated 9.8 out of 10 on the CVSS severity scale. These flaws, tracked as CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, and CVE-2024-13159, are categorized as absolute path traversal issues. Ivanti addressed these vulnerabilities in a January update for its Windows-based product.
Exploitation of these flaws could allow a remote unauthenticated attacker to leak sensitive information. A proof-of-concept exploit has been released, demonstrating how attackers could manipulate the Ivanti software to relay machine account credentials, potentially compromising the server.
The vulnerabilities can be exploited through web-based APIs, allowing attackers to send crafted paths to the system. This could lead to the exposure of the host machine’s NTLMv2 hash, enabling account impersonation and other malicious activities.
Ivanti has urged users to apply the January patches promptly, especially now that proof-of-concept code is publicly available, increasing the risk of exploitation. Users are also advised to implement a second version of the patch that resolves issues with the Windows „Action“ tab, which was affected by the original update.
For more details, visit the source: The Register.