This module exploits a command injection vulnerability in the Ivanti Cloud Services Appliance (CSA) for Ivanti Endpoint Manager. A cookie based code injection vulnerability in the Cloud Services Appliance before `4.6.0-512` allows an unauthenticated user to execute arbitrary code with limited permissions. Successful exploitation results in command execution as the `nobody` user.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/ivanti/csa_unauth_rce_cve_2021_44529msf undefined(csa_unauth_rce_cve_2021_44529) > show actions ...actions...msf undefined(csa_unauth_rce_cve_2021_44529) > set ACTION < action-name >msf undefined(csa_unauth_rce_cve_2021_44529) > show options ...show and set options...msf undefined(csa_unauth_rce_cve_2021_44529) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub