CVE-2023-38035
CRITICAL KEV RANSOMWARE NUCLEIIvanti Sentry MICSLogService Auth Bypass resulting in RCE (CVE-2023-38035)
Title source: metasploitExploitation Summary
CVE-2023-38035 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 22, 2023, with confirmed use in ransomware campaigns.
EIP tracks 5 public exploits from researchers including horizon3ai, LeakIX, mind2hex, including a Metasploit module exploits/linux/http/ivanti_sentry_misc_log_service.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-38035, an unauthenticated command injection vulnerability in Ivanti Sentry. The exploit uses a Hessian proxy to interact with the vulnerable service endpoint and execute arbitrary commands as the root user.
Description
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Exploits (5)
This repository contains a functional exploit for CVE-2023-38035, an unauthenticated command injection vulnerability in Ivanti Sentry. The exploit uses a Hessian proxy to interact with the vulnerable service endpoint and execute arbitrary commands as the root user.
This repository contains a functional exploit for CVE-2023-38035, an authentication bypass vulnerability in MobileIron Sentry. The exploit uses Hessian serialization to invoke the 'getApplianceLicenseInfo' method, extracting company name and contact email without authentication.
This repository contains a functional exploit for CVE-2023-38035, targeting MobileIron systems via a Hessian-based deserialization vulnerability. The exploit includes a Python script (`hessian.py`) for command execution and a bash script (`mics_hunter.sh`) for automated scanning and reverse shell setup.
This repository contains a functional exploit for CVE-2023-38035, targeting MobileIron systems via a Hessian deserialization vulnerability. The exploit includes a Python script (`hessian.py`) for command execution and a bash script (`mics_hunter.sh`) for automated scanning and reverse shell execution.
This Metasploit module exploits an authentication bypass in Ivanti Sentry (CVE-2023-38035) to achieve remote code execution as root via the Hessian binary web service protocol. It leverages the `uploadFileUsingFileInput` function to execute arbitrary commands.
Nuclei Templates (1)
html:"Note: Requires a local Sentry administrative user" || http.html:"note: requires a local sentry administrative user"
body="note: requires a local sentry administrative user"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H