External risk intelligence

Ivanti EPM Agent Portal RCE via Untrusted Data Deserialization.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-29847

The vulnerability affects the agent portal of Ivanti Endpoint Manager, which acts as a gateway or management service. Such components are commonly exposed to the network to manage endpoints across distributed environments, making them a likely target for remote, network-reachable access.

Deserialization

Ivanti Endpoint Manager

before 202220222024

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Ivanti Endpoint Manager's agent portal, allowing unauthenticated remote attackers to execute arbitrary code. This issue stems from the handling of untrusted data during deserialization, potentially impacting systems that manage endpoints. The primary concern is to confirm if our environment uses the affected technology and assess any potential exposure.

Attackers can run code remotely on affected systems.
This could compromise endpoint management capabilities.
Verify if Ivanti Endpoint Manager is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the Ivanti Endpoint Manager agent portal over the network. This portal, designed for managing devices, is exposed externally and doesn't require any authentication to access. By submitting this malicious data, the attacker could trigger the deserialization flaw, leading to the execution of arbitrary code on the affected system.

Remote, unauthenticated network access is required.
Deserialization of untrusted data in the agent portal triggers the vulnerability.
Results in unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote unauthenticated attacker could execute arbitrary code on systems running Ivanti Endpoint Manager. This could occur when the agent portal processes untrusted serialized data, potentially impacting system integrity and allowing unauthorized actions.

System code and operations at risk.
Remote code execution via deserialization.
Compromised system control and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ivanti Endpoint Manager team, likely in coordination with the infrastructure or platform teams, is responsible for addressing this vulnerability. The first practical step is to identify all instances of the affected Ivanti EPM agent portal, assess their network exposure and criticality, and then plan remediation based on the identified risk.

Determine Ivanti EPM ownership and scope.
Verify agent portal network exposure and impact.
Plan and execute risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Endpoint Manager?

Ivanti Endpoint Manager (EPM) is a centralized software platform used by IT teams to manage, secure, and deploy software to devices across an organization. It acts as a command center for distributed environments, allowing administrators to push updates and manage configurations. The agent portal component mentioned in this advisory is a specific part of the system that interfaces with devices and acts as a gateway for these management tasks.

How does CVE-2024-29847 work?

This vulnerability is classified as CWE-502, which is the deserialization of untrusted data. In simple terms, the software accepts data sent from an outside source and attempts to reconstruct it into a functional object without verifying it first. Because the agent portal does not properly validate this input, an attacker can send specially crafted data that forces the system to execute unauthorized commands, granting them control over the affected server.

What must an attacker do to trigger this flaw?

To trigger this vulnerability, an attacker must send malicious, crafted data directly to the Ivanti EPM agent portal over the network. Because the flaw exists in how the portal processes this data, the system will execute the attacker's code automatically. Notably, this does not require any login credentials or previous access to the system; however, it cannot be triggered if the portal is entirely blocked from receiving inbound network traffic.

Why is this a high-priority risk?

This vulnerability is critical because it allows remote, unauthenticated access. According to Halo Surface Signal, the agent portal often functions as a gateway service, which frequently requires it to be reachable over the network to manage endpoints in various locations. If your portal is accessible from the internet, it is at a higher risk of being reached by an attacker, making timely assessment of your specific network configuration essential.

What steps should I take if I use Ivanti EPM?

Your first step is to perform an inventory of all systems running Ivanti EPM to determine which versions are in use. Check your environment against the affected versions listed in the advisory. Once identified, evaluate the network accessibility of your agent portals to understand your current risk level. Finally, coordinate with your IT or infrastructure team to apply the necessary software updates provided by the vendor to resolve the flaw.

References

forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EP…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.