Wiz Details Active Exploitation of Ivanti EPMM Vulnerability Chain

May 20, 2025 · Original article ↗

Summary

Wiz reports active exploitation of Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428, detailing Sliver payloads, database dumping, web shells and reverse shells. Ivanti patches are available.

Key points

CVE-2025-4427 bypasses authentication; CVE-2025-4428 enables remote code execution through unsafe Java Expression Language handling. Chained, they allow unauthenticated RCE.
Wiz says it observed active exploitation beginning May 16, 2025, following Ivanti’s disclosure and the release of public proof-of-concept exploits.
Observed post-exploitation activity included Sliver beacon deployment, reconnaissance, and dumping sensitive tables from the EPMM mifs MySQL database.
Attackers attempted persistence with JSP web shells in plausible-looking paths; another observed method used a direct reverse shell that left no file artifacts and was not recorded in HTTP access logs.
Wiz linked one Sliver C2 IP to earlier PAN-OS exploitation based on certificate continuity, and assessed that the same actor was targeting both types of appliances.
Affected versions include EPMM 11.12.0.4 and earlier, 12.3.0.1 and earlier, 12.4.0.1 and earlier, and 12.5.0.0 and earlier.
Ivanti patched versions are 11.12.0.5, 12.3.0.2, 12.4.0.2, and 12.5.0.1. Wiz recommends prioritizing internet-facing appliances and restricting affected API endpoints until patched.

Article Details

Attack Vectors: Attackers chained CVE-2025-4427, an authentication bypass, with CVE-2025-4428, a post-authentication remote code execution flaw, to achieve unauthenticated RCE on Ivanti EPMM.
A crafted format parameter sent to the /api/v2/featureusage endpoint enabled Java Expression Language injection and command execution.
Attackers accessed and dumped sensitive tables from EPMM's MySQL mifs database.
Attackers attempted persistence by placing JSP web shells at /mi/tomcat/webapps/mifs/401.jsp, /mi/tomcat/webapps/mifs/css/css.css, /mi/tomcat/webapps/mifs/session.jsp, and /mi/tomcat/webapps/mifs/baseURL.jsp.
Some attackers embedded web shells in commands using Base64 encoding; others downloaded web shells from public hosting services.
Attackers used direct reverse Bash shells through the command-execution exploit, avoiding file artifacts and HTTP access-log entries.
Defensive Notes: Patch EPMM to version 11.12.0.5, 12.3.0.2, 12.4.0.2, or 12.5.0.1, prioritizing internet-facing appliances.
Until patches are applied, implement network-level restrictions on /rs/api/v2/* and /mifs/rs/api/v2/* endpoints.

Indicators of compromise

Type	Indicator	Context
IPV4	`100[.]26[.]51[.]59`	IP address hosting a malicious payload under /ws.
IPV4	`150[.]241[.]71[.]231`	IP address associated with attacker deployment of Sliver.
IPV4	`150[.]241[.]97[.]83`	IP address identified as a Sliver C2 server.
IPV4	`185[.]193[.]125[.]65`	IP address hosting Sliver.
IPV4	`27[.]25[.]148[.]183`	IP address associated with direct reverse shell activity.
IPV4	`37[.]219[.]84[.]22`	Source IP observed in activity dumping tables from the EPMM MySQL database.
IPV4	`45[.]38[.]17[.]43`	IP address associated with web-shell deployment.
IPV4	`47[.]120[.]74[.]19`	Reverse-shell callback IP shown in an exploitation request and listed among direct reverse shell activity.
IPV4	`5[.]181[.]159[.]149`	IP address associated with Behinder WS deployment.
IPV4	`75[.]170[.]92[.]132`	IP address associated with Behinder WS deployment.
IPV4	`77[.]221[.]158[.]154`	Sliver C2 IP address; the article reports it was still in operation by the threat actor.
IPV4	`82[.]132[.]235[.]212`	Source IP observed in activity dumping tables from the EPMM MySQL database.
IPV4	`83[.]229[.]126[.]234`	IP address associated with direct reverse shell activity.
IPV4	`88[.]194[.]29[.]21`	IP address associated with MySQL dumping activity.
IPV4	`91[.]193[.]19[.]109`	IP address associated with direct reverse shell activity.
SHA1	`19b4df629f5b15e5ff742c70d2c7dc4dac29a7ce`	SHA1 of an unpacked Sliver beacon associated with the activity.
SHA1	`1b1dda5e8e26da568559e0577769697c624df30e`	SHA1 of a Sliver beacon deployed after EPMM exploitation.
SHA1	`2bd61ce5bdd258c7dcbef53aedb1b018b8e0ae26`	SHA1 of a JSP web shell hosted on a compromised website.
SHA1	`aa2cfeeca6c8e7743ad1a5996fe5ccc3d52e901d`	SHA1 of a JSP web shell written to session.jsp.
SHA1	`ac389c8b7f3d2fcf4fd73891f881b12b8343665b`	SHA1 identified as a Sliver beacon associated with the activity.
SHA1	`dce8faf5fcf5998b6802995914caa988ee1ebd92`	SHA1 of an unpacked Sliver beacon downloaded from attacker infrastructure.
SHA1	`f780151c151b6cec853a278b4e847ef2af3dbc5d`	SHA1 of a packed Sliver beacon downloaded from attacker infrastructure.