Description
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ivanti EPM | 4.6.0-512 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Ivanti Cloud Services Appliance (CSA) Command Injection
exploit/linux/http/ivanti_csa_unauth_rce_cve_2021_44529
Exploit-DB 1
- Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE) EDB-50833 · remote · Mar 22, 2022
GitHub 2 repositories
-
jkana/CVE-2021-44529 ★ 5 · Mar 24, 2022
CVE-2021-44529 PoC
-
jax7sec/CVE-2021-44529 ★ 2 · Apr 16, 2022
CVE-2021-44529 Ivanti EPM 云服务设备 (CSA) 中的代码注入漏洞允许未经身份验证的用户以有限的权限（nobody）执行任意代码。
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ivanti EPM Cloud Services Appliance Code Injection http/cves/2021/CVE-2021-44529.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.