Ivanti Cloud Services Appliance (CSA) Command Injection

This Metasploit module exploits a command injection vulnerability in the Ivanti Cloud Services Appliance (CSA) for Ivanti Endpoint Manager. A cookie based code injection vulnerability in the Cloud Services Appliance before 4.6.0-512 allows an unauthenticated user to execute arbitrary code with limited permissions. Successful exploitation results in command execution as the nobody user.

cloud cloud services code code injection command command injection cookie csa endpoint exploitation exploits injection ivanti manager metasploit permissions results services vulnerability