CVE-2023-46807
📋 TL;DR
An SQL injection vulnerability in Ivanti EPMM's web component allows authenticated users with appropriate privileges to access or modify database data. This affects EPMM versions before 12.1.0.0. Attackers could potentially read sensitive information or alter database contents.
💻 Affected Systems
- Ivanti EPMM (formerly MobileIron Core)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the EPMM database, including theft of sensitive mobile device management data, user credentials, and potential lateral movement to managed devices.
Likely Case
Unauthorized data access or modification within the EPMM database, potentially exposing device information, user data, or configuration details.
If Mitigated
Limited impact due to proper access controls, network segmentation, and monitoring preventing successful exploitation.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit once identified, but this requires authenticated access with appropriate privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.0.0 and later
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
Restart Required: Yes
Instructions:
1. Download EPMM version 12.1.0.0 or later from Ivanti support portal. 2. Backup current EPMM configuration and database. 3. Apply the update following Ivanti's upgrade documentation. 4. Restart EPMM services as required.
🔧 Temporary Workarounds
Restrict User Privileges
allLimit database access privileges to only essential users and applications.
Network Segmentation
allIsolate EPMM systems from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls and principle of least privilege for EPMM users
- Deploy web application firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check EPMM version in administration console: Settings > About. If version is below 12.1.0.0, system is vulnerable.Check Version:
Not applicable - check via EPMM web interfaceVerify Fix Applied:
Verify EPMM version is 12.1.0.0 or higher in administration console and test web component functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries in EPMM logs
- Multiple failed authentication attempts followed by SQL-like queries
- Unexpected database access patterns
Network Indicators:
- SQL syntax in HTTP POST parameters to EPMM web endpoints
- Unusual database connection patterns from EPMM server
SIEM Query:
source="epmm" AND ("SELECT" OR "UNION" OR "INSERT" OR "UPDATE" OR "DELETE") AND status="200"