Detections
Analytics

Ivanti Sentry Authentication Bypass

critical Web App Scanning Plugin ID 114356

Language:

Synopsis

Ivanti Sentry Authentication Bypass

Description

Ivanti Sentry, formerly known as MobileIron Sentry, is vulnerable to an API authentication bypass on the Sentry administrator interface. A remote and unauthenticated attacker can leverage this vulnerability to gain access to sensitive APIs and achieve OS command execution as the root user on the vulnerable instance.

Solution

Ensure that the Ivanti Sentry appliance is in a supported version and apply the vendor patch according to the deployed version. Restrict access to the System Manager Portal to only trusted IP addresses / locations.

See Also

http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html

https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface

https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US

https://www.horizon3.ai/attack-research/attack-blogs/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/

Plugin Details

Severity: Critical

ID: 114356

Type: remote

Published: 6/28/2024

Updated: 6/28/2024

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-38035

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2023-38035

Vulnerability Information

CPE: cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/21/2023

Vulnerability Publication Date: 8/21/2023

CISA Known Exploited Vulnerability Due Dates: 9/12/2023

Reference Information

CVE: CVE-2023-38035