Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified…

CVE-2025-4428 is a Java Expression Language (EL) injection flaw in Ivanti Endpoint Manager Mobile (EPMM) versions ≤12.5.0.0, 12.4.0.1, 12.3.0.1, and 11.12.0.4. The bug lives in the DeviceFeatureUsageReportQueryRequestValidator class: user-supplied input in the format query parameter of the /mifs/rs/api/v2/featureusage endpoint is passed into Spring's AbstractMessageSource for error message interpolation, where it is evaluated as a Java EL expression. This lets an attacker execute arbitrary Java code — specifically Runtime.getRuntime().exec() — on the underlying server. By itself, the endpoint requires authentication (hence the vendor's CVSS 7.2 / PR:H rating). But CVE-2025-4427, a trivial authentication bypass caused by a missing Spring Security <intercept-url> rule on the same /mifs/rs/api/v2/ path, means bean-validation fires *before* @PreAuthorize is checked. Chain the two, and you have unauthenticated, internet-facing RCE with a single GET request.

The vendor's HIGH 7.2 rating dramatically understates real-world risk. Ivanti scored CVE-2025-4428 in isolation, requiring privileged authentication (PR:H). In practice, no attacker has ever needed credentials — every observed exploitation chains CVE-2025-4427 to bypass auth entirely. The effective CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). EPMM is an MDM appliance that must be internet-facing to manage mobile devices, so the attack surface is inherent, not misconfiguration. UNC5221 — a China-nexus espionage group tracked by Mandiant and EclecticIQ — was exploiting this chain as a 0-day before disclosure on May 13, 2025, targeting healthcare, government, telecom, aviation, and defense across three continents. CISA added both CVEs to KEV on May 19, 2025, and published a dedicated Malware Analysis Report (AR25-261A) in September 2025 documenting custom Tomcat-layer implants. Multiple public PoCs (watchTowr, ProjectDiscovery, Metasploit module exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428) make this trivially weaponizable. The EPSS probability of 0.865 places this in the top ~1% of all CVEs. Scoring this anything below CRITICAL is negligent.

1. Patch immediately to fixed versions — Deploy EPMM 12.5.0.1, 12.4.0.2, 12.3.0.2, or 11.12.0.5 within hours, not days. This is a KEV-listed, actively-exploited vulnerability — the noisgate mitigation SLA for CRITICAL is ≤3 days, but active exploitation overrides this to patch/mitigate immediately. Coordinate an emergency change window.
2. Block exploit payload at WAF/reverse proxy — If immediate patching is impossible, deploy a WAF rule blocking requests to /mifs/rs/api/v2/featureusage containing EL injection patterns (${, T(java.lang.Runtime), getClass().forName) in the format query parameter. This is a stopgap — the auth bypass may affect other endpoints not yet publicly documented.
3. Restrict network access to EPMM admin API — Place the /mifs/rs/api/v2/ path behind IP allowlisting or VPN-gated access. Mobile device enrollment endpoints (/mifs/) may need to remain open, but the admin REST API should not be reachable from arbitrary internet sources. Implement this within hours as a compensating control.
4. Hunt for IOCs from CISA MAR AR25-261A — Search EPMM appliances for indicators: web-install.jar in /tmp, SecurityHandlerWanListener.class, WebAndroidAppInstaller.class, ReflectUtil.class in Tomcat directories, unexpected files in /mi/tomcat/webapps/mifs/images/ (especially .jpg files containing command output), and outbound connections to documented C2 IPs (103.244.88.125, 27.25.148.183, 146.70.87.67, 124.223.202.90) and S3 buckets (openrbf.s3.amazonaws.com, etc.).
5. Rotate all credentials stored in EPMM — Assume compromise of LDAP service account credentials, O365 OAuth tokens, MySQL database credentials, and device enrollment certificates. Rotate these immediately. Revoke and reissue O365 refresh tokens for all users whose tokens were managed by EPMM. Review LDAP bind logs for anomalous activity from EPMM's IP.
6. Isolate EPMM from internal network pending forensic review — If you cannot confirm the appliance is uncompromised, segment it from internal AD/LDAP connectivity and initiate forensic collection per Profero's guide. Attackers harvest /mi/files/system/.mifpp for database credentials and dump Tomcat heap for additional secrets.

Run this script on the EPMM appliance itself (or any host with HTTPS connectivity to the target). No authentication is required — the script exploits the same unauthenticated path the attacker uses, but with a safe arithmetic EL expression instead of code execution. Invoke as: sudo bash check_cve_2025_4428.sh https://epmm.example.com. Requires curl and bash.

#!/bin/bash
# check_cve_2025_4428.sh — Safe detection for CVE-2025-4427 + CVE-2025-4428 chain
# Tests EL injection via arithmetic expression (no code execution)
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <EPMM_BASE_URL>"
  echo "Example: $0 https://epmm.example.com"
  exit 2
fi

BASE_URL="${1%/}"
ENDPOINT="/mifs/rs/api/v2/featureusage"
# Safe EL expression: 7*7=49 — no side effects
PAYLOAD='${7*7}'
ENCODED_PAYLOAD=$(python3 -c "import urllib.parse; print(urllib.parse.quote('\${7*7}'))" 2>/dev/null || echo '%24%7B7*7%7D')

URL="${BASE_URL}${ENDPOINT}?format=${ENCODED_PAYLOAD}"

echo "[*] Testing CVE-2025-4427 + CVE-2025-4428 chain"
echo "[*] Target: ${BASE_URL}"
echo "[*] Sending safe EL expression: \${7*7}"
echo ""

RESPONSE=$(curl -sk -o - -w "\n%{http_code}" "$URL" --max-time 15 2>/dev/null)
HTTP_CODE=$(echo "$RESPONSE" | tail -1)
BODY=$(echo "$RESPONSE" | sed '$d')

if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" = "000" ]; then
  echo "UNKNOWN — Could not connect to ${BASE_URL}"
  exit 2
fi

echo "[*] HTTP status: ${HTTP_CODE}"

# Vulnerable: server evaluates 7*7=49 and returns it in the error message
if echo "$BODY" | grep -q '49'; then
  echo ""
  echo "VULNERABLE — EL expression evaluated (found '49' in response)"
  echo "The server evaluated \${7*7} = 49, confirming CVE-2025-4428."
  echo "Unauthenticated access confirms CVE-2025-4427 bypass is also present."
  exit 1
fi

# Patched: server returns error but does NOT evaluate the expression
if [ "$HTTP_CODE" = "400" ] || [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; then
  if ! echo "$BODY" | grep -q '49'; then
    echo ""
    echo "PATCHED — Server rejected the request without evaluating the EL expression"
    exit 0
  fi
fi

# 401/403 without expression evaluation likely means auth bypass is patched
if [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; then
  echo ""
  echo "PATCHED — Authentication required (CVE-2025-4427 bypass not present)"
  exit 0
fi

echo ""
echo "UNKNOWN — Unexpected response (HTTP ${HTTP_CODE}). Manual review required."
echo "Response body (first 500 chars):"
echo "$BODY" | head -c 500
exit 2

1. Ivanti Security Advisory (EPMM May 2025)
2. Rapid7 — Ivanti EPMM Exploit Chain Exploited in the Wild
3. EclecticIQ — China-Nexus UNC5221 Exploiting CVE-2025-4428
4. watchTowr Labs — Expression Payloads Meet Mayhem
5. ProjectDiscovery — Ivanti EPMM RCE Technical Analysis
6. Censys Advisory — CVE-2025-4427/4428 Exposed Instances
7. CISA MAR AR25-261A — Malicious Listener for Ivanti EPMM
8. Wiz — Ivanti EPMM RCE Vulnerability Chain