Critical Vulnerabilities in Ivanti EPMM Exploited

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/
• Blog Title: Critical Vulnerabilities in Ivanti EPMM Exploited
• Suggested Section: Network Services Pentesting -> Pentesting Web (or Generic Hacking) -> Command Injection / Bash injection patterns (add a subsection on Bash arithmetic evaluation injection in RewriteMap/CGI-like scripts)

🎯 Content Summary

Post context / why this matters

Unit 42 (Palo Alto Networks) reports active in-the-wild exploitation of two critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core):
- CVE-2026-1281 (CVSS 9.8)
- CVE-2026-1340 (CVSS 9.8)

Both issues enable unauthenticated remote code execution (RCE) against internet-facing EPMM servers, allowing attackers to execute arbitrary commands ...

🔧 Technical Details

Bash arithmetic-evaluation RCE via RewriteMap: When Apache RewriteMap calls a bash script to rewrite URLs, user-controlled query parameters can be assigned to variables later used in arithmetic comparisons (e.g., [[ $now -gt $userVar ]]). If the attacker can make $userVar resolve to another variable name (e.g., theValue) and then populate theValue with a construct that triggers execution during expansion (the post’s example uses an array-index-style payload like gPath['sleep 5']), bash can execute the embedded command as part of evaluation, yielding unauthenticated command execution. A practical validation technique is timing-based probing: inject sleep 5 and confirm exploitation if the HTTP request stalls ~5 seconds before returning an error (e.g., 404), then follow up with payload delivery (reverse shell, web shell drop).

Feature-to-endpoint mapping for discovery: Identify which RewriteMap-backed s...

🤖 Agent Actions

Updated src/pentesting-web/command-injection.md with a new subsection on bash arithmetic-evaluation RCE in Apache RewriteMap/CGI-style bash scripts. Added attack flow, sample timing-based probe, notes on alternate paths, and guidance on payload staging. Included the Unit 42 Ivanti article as a reference.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting -> Pentesting Web (or Generic Hacking) -> Command Injection / Bash injection patterns (add a subsection on Bash arithmetic evaluation injection in RewriteMap/CGI-like scripts)".

Repository Maintenance:

• MD Files Formatting: 948 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0