gagaltotal/CVE-2026-10523-Ivanti-sentry
PoC files
6 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Go-based tool that sends a crafted POST request to the Ivanti Sentry `/mics/api/v2/sentry/mics-config/handleMessage` endpoint to execute arbitrary OS commands. It constructs a payload containing a user-supplied command, sends it without authentication, and extracts the command output from the XML response, achieving remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Go source file (tot_poc.go) that implement a proof-of-concept exploit for CVE-2026-10520 and CVE-2026-10523. The code sends a crafted POST request to a target Ivanti Sentry endpoint to execute a user-supplied command and displays the output. No concealed backdoor, persistence mechanism, credential theft, or unrelated payload was observed. The tool's behavior is consistent with its stated purpose as a detection/exploitation PoC.
Classification basis and observed behavior
Classification basis
The code actively executes arbitrary OS commands on the target system by sending a crafted payload to a vulnerable endpoint and extracting the output. This goes beyond detection or scanning; it performs the exploitation action of command injection.
tot_poc.go:79-98tot_poc.go:101-125README.md:7Requirements
- Target must be a vulnerable Ivanti Sentry instance with the /mics/api/v2/sentry/mics-config/handleMessage endpoint accessible.
README.md:166 - Network connectivity to the target system is required.
README.md:167
Observed behavior
- Sends an unauthenticated POST request to the vulnerable endpoint with a payload containing a user-supplied OS command.
tot_poc.go:79-98 - Extracts the command output from the XML response body and displays it to the user.
tot_poc.go:101-125tot_poc.go:233-235 - Disables TLS certificate verification, allowing connections to targets with self-signed certificates.
tot_poc.go:54-57
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Sends user-supplied command to /mics/api/v2/sentry/mics-config/handleMessage endpointThis is the documented exploit vector for the stated CVEs; the tool executes the command provided by the operator via the -cmd flag.
tot_poc.go:83-86tot_poc.go:215 - Tls Verification Disabled
- InsecureSkipVerify: trueTLS certificate verification is disabled, which is a security risk but is documented as a feature for testing self-signed certificates and does not constitute a backdoor.
tot_poc.go:55-57 - Proxy Support
- Optional proxy configuration via -p or -proxy flagAllows routing traffic through a proxy; this is a legitimate testing feature and does not indicate hidden exfiltration.
tot_poc.go:148-149tot_poc.go:60-66
What the analysis did not establish
- The evidence includes only two text files (README.md and tot_poc.go) out of six total files; three non-text media files and one additional text file are not provided, so the analysis is based on the available source code and documentation.
- The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness against a live target is not verified.
- Three non-text media files (images) and one unclassified file were present in the repository but were not analyzed; their content could not be reviewed.
- The review is limited to the supplied text evidence; the compiled binary or runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.