CVE-2024-29824: Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

CVE-2024-29824 is a SQL injection flaw in the Core server component of Ivanti Endpoint Manager (EPM). An unauthenticated attacker who can reach the Core server from the same network can abuse it to execute arbitrary code. Because EPM is used to manage and control large numbers of endpoints, successful exploitation can give an attacker a foothold that extends well beyond the management server itself.

Organizations running EPM should treat this as a high-priority issue for any Core server that is reachable by untrusted or semi-trusted hosts on the internal network. Confirm all version and patch details against the official Ivanti advisory before acting.

How it works

The vulnerability is classified as CWE-89 (SQL Injection). In this class of flaw, user-controlled input is incorporated into a database query without proper sanitization or parameterization. An attacker crafts input that alters the intended SQL statement, allowing them to read, modify, or execute commands through the database engine.

According to the CISA summary, the injection point resides in the Ivanti EPM Core server and does not require authentication. An attacker already positioned on the same network can send specially formed requests that trigger the injection and ultimately achieve arbitrary code execution on the server. Exact request formats, parameters, and payload construction are not detailed in the public summary; defenders must rely on the vendor advisory for any technical indicators of compromise or proof-of-concept information.

Am I affected? How to find it in your systems

Ivanti Endpoint Manager is typically deployed in enterprise environments as a central console for software distribution, patching, inventory, and remote control of Windows and other endpoints. The Core server is the central component that stores configuration data and issues management commands.

• Inventory all systems running Ivanti EPM software, focusing on hosts identified as Core servers.
• Check installed product versions and build numbers against the ranges listed in the current Ivanti security advisory for CVE-2024-29824; do not rely on third-party summaries.
• Determine network reachability: any host that can communicate with the Core server on its management ports is a potential attack source.
• Review application and database logs for anomalous SQL statements, unexpected error messages containing SQL fragments, or connections from unusual internal addresses around the time of known exploitation activity.
• If EPM is integrated with other management tools or databases, note those connections as possible lateral-movement paths after compromise.

Public detail on exact vulnerable builds is limited to the vendor advisory; treat any unpatched Core server as potentially affected until confirmed otherwise.

How to remediate

The primary remediation is to apply the vendor-supplied update for Ivanti Endpoint Manager that addresses CVE-2024-29824. Follow the installation and verification steps published by Ivanti exactly.

• Schedule the update during a maintenance window that allows full testing of endpoint management functions afterward.
• After patching, re-validate that the Core server no longer accepts the injection vectors described in the advisory.
• As general hardening for SQL-injection class issues, ensure database accounts used by EPM run with least privilege, enable query parameterization wherever the product configuration allows, and restrict direct database access to only the Core server and authorized administrators.
• If the vendor provides additional configuration changes or workarounds in the advisory, implement those as well.

CISA’s required action is to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable. Confirm the latest guidance directly from Ivanti.

If you can't patch immediately

Until the official update can be applied, reduce exposure with compensating controls that limit network access and increase detection.

• Segment the Core server so that only authorized management subnets and jump hosts can reach it; block all other internal traffic at the firewall or network ACL layer.
• If a web application firewall or reverse proxy sits in front of the Core server, enable rules that detect and block common SQL-injection patterns; treat this as temporary virtual patching only.
• Disable any non-essential Core server features or interfaces that are not required for daily operations, provided the vendor documentation indicates this is safe.
• Increase logging verbosity on the Core server and its backend database; forward logs to a SIEM and alert on failed authentication attempts, unusual query volume, or error strings indicative of injection attempts.
• Monitor for post-exploitation activity such as unexpected process creation, new scheduled tasks, or outbound connections from the Core server.

These measures lower risk but do not eliminate it; plan to patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited management-server vulnerabilities frequently lead to broader network compromise and data exposure. If you have reason to believe an attacker reached your EPM Core server, assume credentials, endpoint inventories, and any stored configuration data may have been accessed. Rotate administrative credentials, review endpoint integrity, and examine network logs for lateral movement. As an additional check, you can run a free exposure scan of your email addresses against known breach data sets to determine whether related accounts appear in public dumps.