VULNERA Pulse

Ivanti — Endpoint Manager Mobile (EPMM)

CVE-2023-35081 / Added: July 31, 2023

HIGH CVSS 7.20

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

Headlines

• Aug. 4, 2023 - Exploitation of Ivanti EPMM Flaw Picking Up as New Vulnerability Is Disclosed
• Aug. 4, 2023 - August 2023 Patch Tuesday forecast: Software security improvements
• Aug. 3, 2023 - Ivanti discloses another vulnerability in MobileIron Core (CVE-2023-35082)
• Aug. 3, 2023 - Rapid7 found a bypass for the recently patched actively exploited Ivanti EPMM bug
• Aug. 3, 2023 - Ivanti Patches Yet Another Critical Flaw
• Aug. 3, 2023 - US fears attacks will continue against Ivanti MDM installs
• Aug. 3, 2023 - Researchers Discover Bypass for Recently Patched Critical Ivanti EPMM Vulnerability
• Aug. 2, 2023 - Ivanti endpoint security needs security upgrade
• Aug. 2, 2023 - Ivanti discloses new critical auth bypass bug in MobileIron Core
• Aug. 2, 2023 - CISA in New Warning Over Ivanti Vulnerabilities
• Aug. 2, 2023 - CISA adds second Ivanti EPMM flaw to its Known Exploited Vulnerabilities catalog
• Aug. 2, 2023 - Ivanti Zero-Day Exploited by APT Since at Least April in Norwegian Government Attack
• Aug. 2, 2023 - Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability
• Aug. 1, 2023 - CISA issues new warning on actively exploited Ivanti MobileIron bugs
• Aug. 1, 2023 - CISA and International Partner NCSC-NO Release Joint Cybersecurity Advisory on Threat Actors Exploiting Ivanti EPMM Vulnerabilities | CISA
• Aug. 1, 2023 - CISA Adds Ivanti Endpoint Manager Mobile Flaw (CVE-2023-35081) to its KEV Catalog
• July 31, 2023 - Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081)
• July 31, 2023 - Second Ivanti EPMM Zero-Day Vulnerability Exploited in Targeted Attacks
• July 30, 2023 - New flaw in Ivanti Endpoint Manager Mobile actively exploited in the wild
• July 29, 2023 - Ivanti Warns of Another Endpoint Manager Mobile Vulnerability Under Active Attack
• July 29, 2023 - A Vulnerability in Ivanti Endpoint Manager Mobile Could Allow for Arbitrary Code Execution
• July 28, 2023 - Ivanti patches new zero-day exploited in Norwegian govt attacks
• July 28, 2023 - Ivanti Releases Security Updates for EPMM to address CVE-2023-35081 | CISA

Back to top ↑

CVE-2022-0543

CRITICAL CVSS 10.00 EPSS Score 97.27 EPSS Percentile 99.76

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Feb. 18, 2022

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Vendors Impacted: Debian, Redis

Products Impacted: Debian-Specific Redis Servers, Redis, Debian Linux

Quotes

• The malware compromises exposed instances of the Redis data store by exploiting the replication feature
• A common attack pattern against Redis in cloud environments is to exploit this feature using a malicious instance to enable replication. This is achieved via connecting to an exposed Redis instance and issuing the SLAVEOF command. Once replication is complete, the attacker can load a malicious module (a Linux shared object file) which extends the functionality of Redis itself

Headlines

• July 31, 2023 - Experts discovered a previously undocumented initial access vector used by P2PInfect worm
• July 31, 2023 - P2PInfect server botnet spreads using Redis replication feature
• July 31, 2023 - New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods

CVE-2023-35078

CRITICAL CVSS 9.80 EPSS Score 11.14 EPSS Percentile 94.38

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: July 25, 2023

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available.

Vendor Impacted: Ivanti

Products Impacted: Endpoint Manager Mobile, Endpoint Manager Mobile (Epmm)

Quotes

• Very limited number of customers
• Make limited changes to the server
• Significant risks to the federal enterprise
• The APT actors have exploited CVE-2023-35078 since at least April 2023
• Help move toward safe, secure, and transparent development of AI technology
• A vulnerability has been discovered in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core
• Allows unauthenticated attackers to access the API in older unsupported versions of MobileIron Core (11.2 and below)
• This vulnerability can be used in conjunction with CVE-2023-35078, bypassing administrator authentication and ACLs restrictions (if applicable)
• The vulnerability was incidentally resolved in MobileIron Core 11.3 as part of work on a product bug. It had not previously been identified as a vulnerability
• Successful exploitation can be used to write malicious files to the appliance, ultimately allowing a malicious actor to execute OS commands on the appliance as the tomcat user
• If exploited, this vulnerability enables an unauthorized, remote (internet-facing) actor to potentially access users’ personally identifiable information and make limited changes to the server
• Mobile device management (MDM) systems are attractive targets for threat actors because they provide elevated access to thousands of mobile devices, and APT actors have exploited a previous MobileIron vulnerability
• Exploited CVE-2023-35078 as a zero day from at least April 2023 through July 2023 to gather information from several Norwegian organizations, as well as to gain access to and compromise a Norwegian government agency’s network
• The Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) are releasing this joint Cybersecurity Advisory (CSA) in response to active exploitation of CVE-2023-35078 and CVE-2023-35081
• A vulnerability has been discovered in MobileIron Core which affects version 11.2 and prior. The vulnerability was incidentally resolved in MobileIron Core 11.3 as part of work on a product bug. It had not previously been identified as a vulnerability
• CVE-2023-35078 is a critical vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) (formerly known as MobileIron Core). The vulnerability allows threat actors to access personally identifiable information (PII) and gain the ability to make configuration changes on compromised systems
• Threat actors with access to these API paths can access PII such as names, phone numbers, and other mobile device details of users on the vulnerable system; make configuration changes to vulnerable systems; push new packages to mobile endpoints; and access Global Positioning System (GPS) data if enabled
• MobileIron Core 11.2 has been out of support since March 15, 2022. Therefore, Ivanti will not be issuing a patch or any other remediations to address this vulnerability in 11.2 or earlier versions. Upgrading to the latest version of Ivanti Endpoint Manager Mobile (EPMM) is the best way to protect your environment from threats

Headlines

• Aug. 4, 2023 - Exploitation of Ivanti EPMM Flaw Picking Up as New Vulnerability Is Disclosed
• Aug. 4, 2023 - August 2023 Patch Tuesday forecast: Software security improvements
• Aug. 3, 2023 - Ivanti discloses another vulnerability in MobileIron Core (CVE-2023-35082)
• Aug. 3, 2023 - Rapid7 found a bypass for the recently patched actively exploited Ivanti EPMM bug
• Aug. 3, 2023 - Ivanti Patches Yet Another Critical Flaw
• Aug. 3, 2023 - US fears attacks will continue against Ivanti MDM installs
• Aug. 3, 2023 - CVE-2023-35082: Critical Security Vulnerability in MobileIron Core
• Aug. 3, 2023 - Researchers Discover Bypass for Recently Patched Critical Ivanti EPMM Vulnerability
• Aug. 2, 2023 - Ivanti endpoint security needs security upgrade
• Aug. 2, 2023 - Ivanti discloses new critical auth bypass bug in MobileIron Core
• Aug. 2, 2023 - CISA in New Warning Over Ivanti Vulnerabilities
• Aug. 2, 2023 - CISA adds second Ivanti EPMM flaw to its Known Exploited Vulnerabilities catalog
• Aug. 2, 2023 - Ivanti Zero-Day Exploited by APT Since at Least April in Norwegian Government Attack
• Aug. 2, 2023 - Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability
• Aug. 1, 2023 - CISA issues new warning on actively exploited Ivanti MobileIron bugs
• Aug. 1, 2023 - CISA and International Partner NCSC-NO Release Joint Cybersecurity Advisory on Threat Actors Exploiting Ivanti EPMM Vulnerabilities | CISA
• Aug. 1, 2023 - CISA Adds Ivanti Endpoint Manager Mobile Flaw (CVE-2023-35081) to its KEV Catalog
• July 31, 2023 - Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081)
• July 31, 2023 - Second Ivanti EPMM Zero-Day Vulnerability Exploited in Targeted Attacks
• July 30, 2023 - New flaw in Ivanti Endpoint Manager Mobile actively exploited in the wild
• July 30, 2023 - Week in review: Ivanti zero-day exploited, MikroTik vulnerability could compromise 900,000 routers
• July 29, 2023 - Researcher releases PoC exploit for MobileIron zero-day bug (CVE-2023-35078)

CVE-2023-2868

CRITICAL CVSS 9.80 EPSS Score 2.77 EPSS Percentile 89.21

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: May 24, 2023

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Vendors Impacted: Barracuda Networks, Barracuda

Products Impacted: Email Security Gateway 600 Firmware, Email Security Gateway 400 Firmware, Email Security Gateway 800 Firmware, Email Security Gateway (Esg) Appliance, Email Security Gateway 600, Email Security Gateway 800, Email Security Gateway 300 Firmware, Email Security Gateway 900 Firmware, Email Security Gateway 400, Email Security Gateway 900, Email Security Gateway 300

Quotes

• Barracuda exploit payloads and reverse shell backdoors
• Novel persistent backdoor executed with root privileges
• Mandiant has identified Submarine on a subset of victims where Mandiant is engaged in incident response
• SEASPY is a persistent and passive backdoor that masquerades as a legitimate Barracuda service. SEASPY monitors traffic from the actor’s C2 server
• SUBMARINE is a novel persistent backdoor executed with root privileges that lives in a Structured Query Language (SQL) database on the ESG appliance. SUBMARINE comprises multiple artifacts—including a SQL trigger, shell scripts, and a loaded library for a Linux daemon—that together enable execution with root privileges, persistence, command and control, and cleanup

Headlines

• Aug. 1, 2023 - CISA: 'Submarine' Backdoor Torpedoes Barracuda Email Security
• July 31, 2023 - New persistent backdoor used in attacks on Barracuda ESG appliances
• July 31, 2023 - CISA Analyzes Malware Used in Barracuda ESG Attacks
• July 31, 2023 - CISA: New Submarine Backdoor Used in Barracuda Campaign
• July 31, 2023 - Malware spotted on Barracuda email gateways
• July 29, 2023 - CISA warns about SUBMARINE Backdoor employed in Barracuda ESG attacks

CVE-2023-3519

CRITICAL CVSS 9.80 EPSS Score 4.69 EPSS Percentile 91.52

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: July 19, 2023

Unauthenticated remote code execution

Vendor Impacted: Citrix

Products Impacted: Netscaler Adc And Netscaler Gateway, Netscaler Gateway, Netscaler Application Delivery Contr

Quotes

• May be under limited, targeted exploitation
• [Cipher Block Chaining] mode and PKCS#7 padding are the default values for AES encryption in .NET
• We can say it's fairly standard China Chopper but we do not want to disclose more under the circumstances. I can say the amount we detect is much lower than the amount we believe to be out there, unfortunately
• Exploits of CVE-2023-3519 on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible

Headlines

• Aug. 3, 2023 - Hundreds of Citrix NetScaler ADC and Gateway Servers Hacked in Major Cyber Attack
• Aug. 3, 2023 - Hundreds of Citrix Endpoints Compromised With Webshells
• Aug. 2, 2023 - Hackers already installed web shells on 581 Citrix servers in CVE-2023-3519 attacks
• Aug. 2, 2023 - Over 640 Citrix servers backdoored with web shells in ongoing attacks
• July 31, 2023 - It's Hot Zero-Day Summer for Apple, Google, and Microsoft Security Fixes

CVE-2018-13379

CRITICAL CVSS 9.80 EPSS Score 97.49 EPSS Percentile 99.95

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: June 4, 2019

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

Vendor Impacted: Fortinet

Product Impacted: Fortios

Quotes

• In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and targeted unpatched, internet-facing systems
• This advisory provides details on the Common Vulnerabilities and Exposures (CVEs) routinely and frequently exploited by malicious cyber actors in 2022 and the associated Common Weakness Enumeration(s) (CWE)
• Malicious cyber actors generally have the most success exploiting known vulnerabilities within the first two years of public disclosure – the value of such vulnerabilities gradually decreases as software is patched or upgraded

Headlines

• Aug. 4, 2023 - Five Eyes Agencies Call Attention to Most Frequently Exploited Vulnerabilities
• Aug. 4, 2023 - Legacy Flaws Dominate Top 12 Vulnerabilities List
• Aug. 4, 2023 - Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities
• Aug. 4, 2023 - CISA, FBI, and NSA published the list of 12 most exploited vulnerabilities of 2022
• Aug. 3, 2023 - FBI, CISA, and NSA reveal top exploited vulnerabilities of 2022

CVE-2023-35081

HIGH CVSS 7.20

CISA Known Exploited

Published: Aug. 3, 2023

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.

Vendor Impacted: Ivanti

Product Impacted: Endpoint Manager Mobile (Epmm)

Quotes

• Make limited changes to the server
• Significant risks to the federal enterprise
• A vulnerability has been discovered in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core
• Allows unauthenticated attackers to access the API in older unsupported versions of MobileIron Core (11.2 and below)
• The vulnerability was incidentally resolved in MobileIron Core 11.3 as part of work on a product bug. It had not previously been identified as a vulnerability
• CVE-2023-35081 could be chained with CVE-2023-35082 to allow an attacker write malicious webshell files to the appliance, which may then be executed by the attacker
• Successful exploitation can be used to write malicious files to the appliance, ultimately allowing a malicious actor to execute OS commands on the appliance as the tomcat user
• Mobile device management (MDM) systems are attractive targets for threat actors because they provide elevated access to thousands of mobile devices, and APT actors have exploited a previous MobileIron vulnerability
• The Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) are releasing this joint Cybersecurity Advisory (CSA) in response to active exploitation of CVE-2023-35078 and CVE-2023-35081
• A vulnerability has been discovered in MobileIron Core which affects version 11.2 and prior. The vulnerability was incidentally resolved in MobileIron Core 11.3 as part of work on a product bug. It had not previously been identified as a vulnerability
• Threat actors with access to these API paths can access PII such as names, phone numbers, and other mobile device details of users on the vulnerable system; make configuration changes to vulnerable systems; push new packages to mobile endpoints; and access Global Positioning System (GPS) data if enabled
• MobileIron Core 11.2 has been out of support since March 15, 2022. Therefore, Ivanti will not be issuing a patch or any other remediations to address this vulnerability in 11.2 or earlier versions. Upgrading to the latest version of Ivanti Endpoint Manager Mobile (EPMM) is the best way to protect your environment from threats

Headlines

• Aug. 4, 2023 - Exploitation of Ivanti EPMM Flaw Picking Up as New Vulnerability Is Disclosed
• Aug. 4, 2023 - August 2023 Patch Tuesday forecast: Software security improvements
• Aug. 3, 2023 - Ivanti discloses another vulnerability in MobileIron Core (CVE-2023-35082)
• Aug. 3, 2023 - Rapid7 found a bypass for the recently patched actively exploited Ivanti EPMM bug
• Aug. 3, 2023 - Ivanti Patches Yet Another Critical Flaw
• Aug. 3, 2023 - US fears attacks will continue against Ivanti MDM installs
• Aug. 3, 2023 - Researchers Discover Bypass for Recently Patched Critical Ivanti EPMM Vulnerability
• Aug. 2, 2023 - Ivanti endpoint security needs security upgrade
• Aug. 2, 2023 - Ivanti discloses new critical auth bypass bug in MobileIron Core
• Aug. 2, 2023 - CISA in New Warning Over Ivanti Vulnerabilities
• Aug. 2, 2023 - CISA adds second Ivanti EPMM flaw to its Known Exploited Vulnerabilities catalog
• Aug. 2, 2023 - Ivanti Zero-Day Exploited by APT Since at Least April in Norwegian Government Attack
• Aug. 2, 2023 - Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability
• Aug. 1, 2023 - CISA issues new warning on actively exploited Ivanti MobileIron bugs
• Aug. 1, 2023 - CISA and International Partner NCSC-NO Release Joint Cybersecurity Advisory on Threat Actors Exploiting Ivanti EPMM Vulnerabilities | CISA
• Aug. 1, 2023 - CISA Adds Ivanti Endpoint Manager Mobile Flaw (CVE-2023-35081) to its KEV Catalog
• July 31, 2023 - Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081)
• July 31, 2023 - Second Ivanti EPMM Zero-Day Vulnerability Exploited in Targeted Attacks
• July 30, 2023 - New flaw in Ivanti Endpoint Manager Mobile actively exploited in the wild

CVE-2023-30799

HIGH CVSS 7.20 EPSS Score 0.06 EPSS Percentile 20.78

Actively Exploited Remote Code Execution

Published: July 19, 2023

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.

Vendor Impacted: Mikrotik

Product Impacted: Routeros

Quotes

• Hold Microsoft responsible for its negligent cyber security practices
• Help move toward safe, secure, and transparent development of AI technology

Headlines

• July 31, 2023 - Researchers Disclose MikroTik RouterOS Security Flaw, Putting Hundreds of Thousands of Devices at Risk
• July 31, 2023 - US senator victim-blames Microsoft for Chinese hack
• July 30, 2023 - newsletter Round 430 by Pierluigi Paganini – International edition
• July 30, 2023 - Week in review: Ivanti zero-day exploited, MikroTik vulnerability could compromise 900,000 routers

CVE-2023-37979

MEDIUM CVSS 6.10 EPSS Score 0.04 EPSS Percentile 6.96

Public Exploits Available

Published: July 27, 2023

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.

Quotes

• For some cases, plugin or theme code need to call certain function or class from user supplied string. Always try to check and restrict which function or class the user could directly call. Also pay extra attention to an export data action and always implement permission or access control check to the related functions

Headlines

• July 31, 2023 - Three flaws in Ninja Forms plugin for WordPress impact 900K sites
• July 31, 2023 - Multiple Flaws Found in Ninja Forms Plugin Leave 800,000 Sites Vulnerable

CVE-2023-20583

MEDIUM CVSS 4.70 EPSS Score 0.04 EPSS Percentile 6.93

Remote Code Execution

Published: Aug. 1, 2023

A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information.

Vendor Impacted: Amd

Product Impacted: *

Quotes

• Read out the transparent pixel code from address 0x3E00A040
• Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channels
• Nevertheless, we assume that nearly all CPUs are affected by Collide+Power as the exploited leakage is fundamentally a result of how we build CPUs
• A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information
• Previous software-based power side-channels attacks like PLATYPUS and Hertzbleed target cryptographic algorithms and needed precise knowledge of the algorithm or victim program executed on the target machine. In contrast, Collide+Power targets the CPU memory subsystem, which abstracts the precise implementation away as all programs require the memory subsystem in some way. Furthermore, any signal reflecting the power consumption can be used due to the fundamental physical power leakage exploited by Collide+Power

Headlines

• Aug. 2, 2023 - Performance and security clash yet again in “Collide+Power” attack
• Aug. 2, 2023 - New Collide+Power side-channel attack impacts almost all CPUs
• Aug. 2, 2023 - CVE-2023-20583 - A new vulnerability impacting CPUs
• Aug. 1, 2023 - Another CPU data-leak flaw found. Luckily, it's impractical
• Aug. 1, 2023 - Nearly All Modern CPUs Leak Data to New Collide+Power Side-Channel Attack