PT-2021-11716 · Mobileiron · Mobileiron

Published 2021-03-29 · Updated 2024-08-04 · CVE-2020-35138

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MobileIron agents through 2021-03-22 for Android and iOS

Description: The issue concerns a hardcoded encryption key used to encrypt username and password details during the authentication process. This key is located in the com/mobileiron/common/utils/C4928m.java file. It has been noted that there is no connection between credential encryption and the Man-in-the-Middle (MiTM) attack.

Recommendations: For MobileIron agents through 2021-03-22 for Android and iOS, consider updating to a version released after 2021-03-22 to ensure the removal of the hardcoded encryption key. As a temporary workaround, restrict access to sensitive authentication processes until a patch is available. Avoid using the affected MobileIron agents for sensitive transactions until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-35138

Affected Products

Mobileiron

References · 8

• 🔥 https://github.com/optiv/rustyIron · Exploit
• 🔥 https://optiv.com/insights/source-zero/blog/mobileiron-mdm-contains-static-key-allowing-account-enumeration · Exploit
• 🔥 https://optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration · Exploit
• https://osv.dev/vulnerability/CVE-2020-35138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35138 · Security Note
• https://ivanti.com/blog/a-warranted-response-to-inaccurate-optiv-research · Note
• https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US · Note
• https://t.me/cvenotify/12265 · Telegram Post