automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -86535,7 +86535,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2025-06-04 12:56:51 +0000",
+    "mod_time": "2025-06-04 15:24:43 +0000",
     "path": "/modules/exploits/linux/local/udev_persistence.rb",
     "is_install_path": true,
     "ref_name": "linux/local/udev_persistence",
@@ -99833,6 +99833,69 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_multi/http/ivanti_epmm_rce_cve_2025_4427_4428": {
+    "name": "Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution",
+    "fullname": "exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2025-05-13",
+    "type": "exploit",
+    "author": [
+      "CERT-EU",
+      "Sonny Macdonald",
+      "Piotr Bazydlo",
+      "remmons-r7"
+    ],
+    "description": "This module exploits an unauthenticated remote code execution exploit chain for Ivanti EPMM,\n          tracked as CVE-2025-4427 and CVE-2025-4428. An authentication flaw permits unauthenticated\n          access to an administrator web API endpoint, which allows for code execution via expression\n          language injection. This module executes in the context of the 'tomcat' user. This module\n          should also work on many versions of MobileIron Core (rebranded as Ivanti EPMM).",
+    "references": [
+      "CVE-2025-4427",
+      "CVE-2025-4428",
+      "URL-https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US",
+      "URL-https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428",
+      "URL-https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability"
+    ],
+    "platform": "Python",
+    "arch": "python",
+    "rport": 443,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Default"
+    ],
+    "mod_time": "2025-06-03 13:39:01 +0000",
+    "path": "/modules/exploits/multi/http/ivanti_epmm_rce_cve_2025_4427_4428.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/ivanti_epmm_rce_cve_2025_4427_4428",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_multi/http/jboss_bshdeployer": {
     "name": "JBoss JMX Console Beanshell Deployer WAR Upload and Deployment",
     "fullname": "exploit/multi/http/jboss_bshdeployer",