CVE-2023-38035
📋 TL;DR
This vulnerability allows attackers to bypass authentication on the Ivanti MobileIron Sentry administrative interface due to an overly permissive Apache HTTPD configuration. Attackers can gain unauthorized administrative access without credentials. Organizations running Ivanti MobileIron Sentry versions 9.18.0 and below are affected.
💻 Affected Systems
- Ivanti MobileIron Sentry
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise leading to remote code execution, data exfiltration, and complete system takeover.
Likely Case
Unauthorized administrative access allowing configuration changes, user data access, and potential lateral movement.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. CISA has added this to its Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.18.1 and above
Vendor Advisory: https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
Restart Required: Yes
Instructions:
1. Download and install Ivanti MobileIron Sentry version 9.18.1 or later from the Ivanti support portal. 2. Apply the patch following Ivanti's installation guide. 3. Restart the Sentry service to apply changes.
🔧 Temporary Workarounds
Restrict Apache HTTPD Configuration
allModify Apache configuration to properly restrict access to administrative interfaces
# Edit Apache configuration files to add proper authentication and access controls
# Example: Add Require valid-user and proper AuthType directives
Network Segmentation
allIsolate Sentry administrative interface from untrusted networks
# Configure firewall rules to restrict access to Sentry admin interface
# Example: iptables -A INPUT -p tcp --dport [admin_port] -s [trusted_ips] -j ACCEPT
🧯 If You Can't Patch
- Immediately restrict network access to the Sentry administrative interface using firewall rules
- Implement additional authentication layers such as VPN or reverse proxy with strong authentication
🔍 How to Verify
Check if Vulnerable:
Check Sentry version via admin interface or command line. Versions 9.18.0 and below are vulnerable.Check Version:
Check version in Sentry web interface or run system diagnostic commands specific to your deployment.Verify Fix Applied:
Verify installation of version 9.18.1 or later and test authentication bypass attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to admin endpoints
- Authentication bypass patterns in Apache logs
- Unusual administrative activity from unexpected sources
Network Indicators:
- Direct access to administrative endpoints without authentication headers
- Unusual traffic patterns to Sentry admin interface
SIEM Query:
source="apache" AND (uri="/admin/*" OR uri="/api/*") AND NOT auth_success="true"🔗 References
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035
