Authenticated S3 bucket write control via filename

External filename control in Ivanti Endpoint Manager before 2024 SU7 allows remote authenticated users to write to an S3 recording bucket. The Core accepts an attacker-controlled filename for an S3 write, but Ivanti has not identified the responsible function or validation failure. An authenticated account and an S3 bucket configured for session recording are required; exploitation grants full write control over that bucket.