In swift response to a potential security breach, Ivanti has moved to address a recently discovered zero-day vulnerability that may have been exploited in the wild.The newly identified security flaw, designated as CVE-2023-38035, impacts Ivanti’s Sentry software (previously known as MobileIron Sentry). Sentry serves as a mobile gateway responsible for managing and encrypting communication between mobile devices and backend systems within enterprise environments.
Rated with a high severity score of 9.8 on the Common Vulnerability Scoring System (CVSS), this critical vulnerability has prompted Ivanti to take immediate action.
While the company has not definitively confirmed any instances of exploitation, a post on the company’s forum indicates that “as of now, we are only aware of a limited number of customers impacted by CVE-2023-38035.”
The impact of this vulnerability is wide-ranging, encompassing all supported versions of the Sentry software, namely Versions 9.18, 9.17, and 9.16, as well as older iterations.Notably, the vulnerability does not extend to other Ivanti products such as Ivanti EPMM, MobileIron Cloud, or Ivanti Neurons for mobile device management (MDM).
In the context of potential exploitation, this security flaw permits an unauthenticated actor to gain access to sensitive application programming interfaces (APIs) that are utilized for configuring Ivanti Sentry through the administrator portal, often referred to as MICS.
Cause of the bug lies in an insufficiently restrictive configuration of Apache HTTPD
The root cause of the bug lies in an insufficiently restrictive configuration of Apache HTTPD, leading to authentication bypass controls on the administrative interface.However, Ivanti has highlighted that the risk of exploitation is lower for customers who do not expose port 8443 to the internet.
To rectify the issue, Ivanti has released fixes in the form of remote package manager (RPM) scripts, enabling users to swiftly apply the necessary updates to safeguard their systems.
Ivanti has had an eventful August in terms of security response. Earlier in the month, the company addressed CVE-2023-35082, a follow-up vulnerability to CVE-2023-35078, which pertained to an API authentication flaw within its endpoint manager, potentially compromising user data and configuration details.
Moreover, on August 17, reports emerged that Ivanti had successfully patched a series of buffer overflows discovered within its Avalanche software, further highlighting the company’s commitment to maintaining robust cybersecurity practices.