'Ongoing' Ivanti hijack bug exploitation reaches clouds
Nothing like insecure code in security suites
The "ongoing exploitation" of two Ivanti bugs has now extended beyond on-premises environments and hit customers' cloud instances, according to security shop Wiz.
CVE-2025-4427 is an authenticated bypass vulnerability and CVE-2025-4428 is a post-authentication remote-code execution (RCE) flaw. Together they allow a miscreant to run malware on a vulnerable deployment and hijack it. Both holes affect Ivanti Endpoint Manager Mobile (EPMM), on-premises software used to manage company-issued devices and applications and secure access to sensitive corporate data. The security suite can also be deployed in the cloud using customer-managed resources.
There are at least a couple proof-of-concept (POC) exploits on the loose for these holes, so if you haven't already: Patch now.
Ivanti disclosed the bugs and issued patches for both last week, warning in a security alert it was "aware of a very limited number of customers" whose products had been exploited.
The flaws involve some unnamed open source libraries used in its code, according to a statement an Ivanti spokesperson emailed The Register Tuesday:
Ivanti has released a fix for vulnerabilities associated with open-source libraries used in our on-premise Endpoint Manager Mobile products. We are actively working with our security partners and the maintainers of the libraries to determine if a CVE against the libraries is warranted. We remain committed to collaboration and transparency with our stakeholders and the broader security ecosystem.
At the time of disclosure, we are aware of a very limited number of on-premise EPMM customers whose solution has been exploited.
Wiz, on the other hand, asserts the exploitation extends into customers' self-managed cloud environments.
"Wiz Research has observed ongoing exploitation of these vulnerabilities in-the-wild targeting exposed and vulnerable EPMM instances in cloud environments since May 16," the cloud security firm's bug hunters Merav Bar, Shahar Dorfman, and Gili Tikochinski wrote Tuesday.
While we don't know who is behind the attacks, in at least once instance the miscreants used their ill-gotten access to deploy a remote-control program called Sliver within victims' cloud environments, we're told. Sliver is a favorite of all types of baddies, from Chinese and Russian government goons to ransomware gangs, because it ensures long-term total access to the compromised system for future snooping, ransomware deployment, credential stealing campaigns, and many other illicit activities.
On Monday, the US govt's Cybersecurity and Infrastructure Security Agency (CISA) added both bugs to its Known Exploited Vulnerabilities Catalog.
While neither CVE-2025-4427 nor CVE-2025-442 is considered critical on their own, receiving CVSS severity scores of 5.3 (medium) and 7.2 (high) out of 10, respectively, "in combination they should certainly be treated as critical," according to the Wiz kids.
The soon-to-be-Google-owned security shop said the attacks coincide with the emergence of POCs including those published by watchTowr and ProjectDiscovery on May 15.
About those open-source libraries
Wiz also indicates that the unnamed open-source libraries involved the insecure processing of Java Expression Language, and Spring.
We're told CVE-2025-4428 stems from the unsafe use of Java Expression Language in error messages. "It arises from the unsafe handling of user-supplied input within error messages processed via Spring's AbstractMessageSource, which allows attacker-controlled EL (Expression Language) injection," the researchers wrote.
Meanwhile, CVE-2025-4427, according to Wiz, is caused by improper request handling in EPMM's route configuration:
The security researchers say they spotted "multiple malicious payloads" being deployed post exploitation, including the Sliver code mentioned earlier.
Routes like /rs/api/v2/featureusage were unintentionally exposed without requiring authentication due to missing intercept-url rules in Spring Security configurations. This allows unauthenticated access to the RCE sink, enabling full pre-auth RCE when chained with CVE-2025-4428.
This remote-control tool used 77.221.157[.]154 as its command-and-control server, which is significant because Wiz spotted this same IP address being used to attack similar flaws in exposed Palo Alto Networks' appliances in the fall. That didn't end well for buggy PAN-OS kits.
According to the bug hunters, the IP address is still in operation and a TLS certificate used by it hasn't changed since November 2024. "This continuity leads us to conclude that the same actor has been opportunistically targeting both PAN-OS and Ivanti EPMM appliances," the Wiz kids wrote.
The Register asked Ivanti for more information about the scope of exploitation, the open-source libraries linked to the security flaws, and other details. A spokesperson side-stepped those queries, and instead stressed the flaws are not present in Ivanti Neurons for MDM, Ivanti's own cloud-based offering.
"If a customer chooses to host their EPMM appliances in a cloud environment or other virtual machine infrastructure, this would be entirely chosen and managed by the customer," the spinner said. "To be clear: these vulnerabilities are not present in Ivanti Neurons for MDM."
Wiz researchers more or less concurred.
"We can confirm that the incident we found was on cloud hosted virtual appliances and not an on-prem device," Gili Tikochinski, malware researcher at Wiz, told The Register.
"This doesn't mean that the attacker explicitly targeted cloud environments because from an outside network perspective it is hard to differentiate the two deployment options but it does mean that both cloud and on-prem customers are at risk." ®