CVE-2024-13171
Published: 14 January 2025
Summary
CVE-2024-13171 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates information input validation checks at interfaces to enforce proper filename validation and block malicious file uploads exploiting CWE-434.
Enforces restrictions on information inputs to limit dangerous file types and names, preventing unrestricted uploads that lead to RCE.
Requires timely identification, reporting, and correction of flaws like insufficient filename validation through patching as specified in Ivanti's advisory.
NVD Description
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
Deeper analysisAI
CVE-2024-13171 is an insufficient filename validation vulnerability affecting Ivanti Endpoint Manager (EPM) versions prior to the January 2025 Security Update for EPM 2024 and the 2022 SU6 January 2025 Security Update. This flaw, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), enables a remote unauthenticated attacker to achieve remote code execution on the targeted system. The vulnerability stems from inadequate checks on filenames, allowing malicious files to bypass intended restrictions.
Exploitation requires local user interaction, as indicated by the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A remote unauthenticated attacker can leverage this issue by tricking a local user into interacting with a specially crafted file, leading to arbitrary code execution with high confidentiality, integrity, and availability impacts. The low attack complexity and lack of required privileges make it feasible for attackers with network access to deliver payloads that prompt user action.
Ivanti's security advisory for EPM January 2025, available at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6, details the patch releases addressing this vulnerability. Security practitioners should apply the specified January 2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the risk of exploitation.
Details
- CWE(s)