CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
Unauthenticated attackers can execute arbitrary code on Ivanti EPM Cloud Services Appliance with limited permissions.
- Exploited in the wild
- Since 25 Mar 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-44529?
CVE-2021-44529 is a critical code injection vulnerability in Ivanti EPM, published on 8 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Weakness: CWE-94
Which versions are affected by CVE-2021-44529?
It affects 1 product.
Products include Ivanti Endpoint Manager Cloud Services Appliance.
How do I fix CVE-2021-44529?
No fix has been published for CVE-2021-44529 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2024.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-44529 being exploited?
Yes. Attackers have exploited CVE-2021-44529 in the wild since at least 25 Mar 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Ivanti EPM
- CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal
- CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command Injection
- CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) SQL Injection
- CVE-2024-9381 Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.
Sources
Also known as GHSA-wg22-f643-fv8w.