Ivanti EPMM Pre-Auth RCE via Bash Arithmetic Expansion (CVE-2026-1281 / CVE-2026-1340)

Metadata

Affected Target

Summary

This is a self-contained Docker/Nginx lab that reproduces the vulnerable Bash logic behind Ivanti EPMM’s pre-auth RCE (as documented by watchTowr Labs). The map-appstore-url CGI script parses comma-separated key=value pairs from a crafted appstore URL in a loop, reusing a shared theValue variable across iterations. By supplying st=theValue (so gStartTime literally becomes the string "theValue") followed by an h= parameter containing gPath[\command`], the script's later Bash arithmetic comparison ([[ … -gt ${gStartTime} ]]) resolves gStartTimeas a variable reference back totheValue, whose content is an array index containing command substitution — triggering arbitrary command execution. The lab includes a test-exploit.sh` harness that verifies file-creation, custom-content, and time-based (sleep) command execution against the dummy target.

Vulnerability Details

Root Cause

Bash’s arithmetic evaluation context ([[ ... -gt ... ]]) treats a variable’s string content as another variable name if it looks like one, and further expands array-style index syntax containing backticks as command substitution — so reusing a loop variable (theValue) across unrelated key parses lets attacker-controlled input flow into an arithmetic/array-index context and execute commands.

Attack Vector

1. Send a request to the map-appstore-url endpoint with URL path /mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=<10-digit>,h=gPath%5B%60COMMAND%60%5D/uuid.ipa.
2. The st=theValue parameter (literal string “theValue” padded to 10 characters) sets gStartTime="theValue".
3. The subsequent h=gPath[\COMMAND`]parameter sets the loop's sharedtheValue` variable to an array-index expression containing the attacker’s command.
4. When the script later evaluates [[ ${currentTime} -gt ${gStartTime} ]], Bash’s arithmetic context resolves gStartTime → "theValue" → the attacker’s gPath[\COMMAND`]`, triggering command substitution and executing the injected command as the web server user (root in the lab container).

Impact

Unauthenticated remote code execution on the vulnerable EPMM component, as demonstrated by writing arbitrary files and confirming root-level command output (id returns uid=0(root)) in the lab.

Environment / Lab Setup

Target:   Docker container running Nginx + fcgiwrap serving the vulnerable map-appstore-url Bash CGI script (docker-compose up --build -d, exposed on localhost:8180)
Attacker: curl or any HTTP client

Proof of Concept

PoC Script

See test-exploit.sh, scripts/map-appstore-url, docker-compose.yml, Dockerfile, and nginx.conf in this folder.

1
2

docker-compose up --build -d
./test-exploit.sh http://localhost:8180

test-exploit.sh runs a health check, then sends crafted appstore URLs (id > /mi/poc, echo EXPLOITED > /mi/custom, and a sleep 3 timing check) against the dummy target and verifies command execution by inspecting the resulting files and response timing.

Detection & Indicators of Compromise

GET /mifs/c/appstore/fob/*/*/sha256:*st=theValue*h=gPath%5B%60*

Signs of compromise:

• Requests to map-appstore-url / appstore endpoints with st=theValue (or similarly crafted 10-character values) combined with backtick/array-index syntax in the h= parameter
• Unexpected files or command output written by the web server process (e.g. in EPMM’s data directories)
• Anomalous CGI/nginx process spawning shell children shortly after appstore requests

Remediation

References

• Source repository
• WatchTowr Labs blog post referenced in source README

Notes

Mirrored from https://github.com/YunfeiGE18/CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE on 2026-07-05.