Ivanti Releases Urgent Patch for EPMM Zero-Day Vulnerability Under Active Exploitation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-35078 | Authentication Bypass in Ivanti Endpoint Manager Mobile (EPMM) Exposes PII Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass (CWE-287) that allows a remote, unauthenticated attacker to access specific API paths on a vulnerable server. Because these endpoints require no credentials, any attacker who can reach the server can invoke them directly. Through these paths an attacker can read PII such as user names, phone numbers, and mobile device details, and can also make configuration changes, including installing software and modifying security profiles on enrolled devices, giving attackers a lever into the managed mobile fleet. Organizations running EPMM, typically enterprises and government agencies using it for mobile device management, are affected; exact affected version ranges should be taken from Ivanti's advisory. The flaw is actively exploited: it was added to CISA's KEV on 2023-07-25 with known ransomware use, EPSS is ~100%, while no public PoC or CVSS score is yet available. Do: Apply Ivanti's patched EPMM releases per the vendor's instructions immediately, as patching or discontinuing use is the CISA KEV required action. Hunt for unauthenticated requests to the affected API paths, and review enrolled devices for unexpected software installs or modified security profiles, since ransomware operators are known to have used this flaw. Verify internet-exposed EPMM servers are prioritized for remediation and that managed-device configurations have not been tampered with. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of deployed EPMM instances (enterprise/government MDM), with several thousand internet-exposed |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 11.10.0.2 | ave been made available in versions 11.8.1.1, 11.9.1.1, and 11.10.0.2, according to security researcher Kevin Beaumont. Update CI |
| ipv4 | 11.8.1.1 | Patches for the issue have been made available in versions 11.8.1.1, 11.9.1.1, and 11.10.0.2, according to security researcher |
| ipv4 | 11.9.1.1 | or the issue have been made available in versions 11.8.1.1, 11.9.1.1, and 11.10.0.2, according to security researcher Kevin Beau |
Full article401 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 25, 2023Enterprise Security / Zero Day
Ivanti is warning users to update their Endpoint Manager Mobile (EPMM) mobile device management software (formerly MobileIron Core) to the latest version that fixes an actively exploited zero-day vulnerability.
Dubbed CVE-2023-35078, the issue has been described as a remote unauthenticated API access vulnerability that impacts currently supported version 11.4 releases 11.10, 11.9, and 11.8 as well as older releases. It has the maximum severity rating of 10 on the CVSS scale.
"An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication," the company said in a terse advisory.
"If exploited, this vulnerability enables an unauthorized, remote (internet-facing) actor to potentially access users' personally identifiable information and make limited changes to the server."
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said an adversary with access to the API paths could exploit them to obtain personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system.
"An attacker can also make other configuration changes, including creating an EPMM administrative account that can make further changes to a vulnerable system," CISA added.
The Utah-based IT software firm further said that it's aware of active exploitation of the bug against a "very limited number of customers" but did not disclose additional specifics about the nature of the attacks or the identity of the threat actor behind them.
That having said, the Norwegian National Security Authority (NSM) has since confirmed that the zero-day vulnerability was exploited by unknown threat actors to target the Government Security and Service Organization (DSS).
Patches for the issue have been made available in versions 11.8.1.1, 11.9.1.1, and 11.10.0.2, according to security researcher Kevin Beaumont.
Update
CISA has placed CVE-2023-35078 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. Federal Civilian Executive Branch (FCEB) agencies are therefore required to apply the vendor-provided patches by August 15, 2023, to secure their networks against active threats.
Ivanti has not divulged the scale of the attacks, declining to say exactly how many users may have been impacted or whether it has observed any sign of data exfiltration as a result of the intrusions.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/07/ivanti-releases-urgent-patch-for-epmm.html