PT-2023-4447 · Apache+1 · Apache Httpd+1

Published 2023-08-21 · Updated 2025-12-01 · CVE-2023-38035

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ivanti MobileIron Sentry versions 9.18.0 and below

Description A security vulnerability in the MICS Admin Portal of Ivanti MobileIron Sentry may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. This vulnerability can be exploited by unauthenticated users to access sensitive APIs used to configure Ivanti Sentry. The issue is being actively exploited in the wild, with reports of its use in attacks. Researchers have released proof-of-concept (PoC) exploit code for this flaw.

Recommendations For Ivanti MobileIron Sentry versions 9.18.0 and below, update to the latest version to address the authentication bypass vulnerability. As a temporary workaround, consider restricting access to the MICS Admin Portal and the vulnerable Apache HTTPD configuration to minimize the risk of exploitation. Additionally, monitor for any suspicious activity related to the exploitation of this vulnerability.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

BDU:2023-04838

CVE-2023-38035

Affected Products

Apache Httpd

Ivanti Mobileiron Sentry

References · 114

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_sentry_misc_log_service.rb · Exploit
• 🔥 https://github.com/horizon3ai/CVE-2023-38035 · Exploit
• 🔥 https://github.com/LeakIX/sentryexploit · Exploit
• 🔥 http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html · Exploit
• https://bdu.fstec.ru/vul/2023-04838 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38035 · Security Note
• https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US · Security Note
• https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38035 · Vendor Advisory
• https://twitter.com/RMInfoSec/status/1693985379811254689 · Twitter Post
• https://twitter.com/seconize_co/status/1696742291812110745 · Twitter Post
• https://twitter.com/linux_ly/status/1808924879879876666 · Twitter Post
• https://twitter.com/ReconOne_bk/status/1700474247125041456 · Twitter Post
• https://twitter.com/momika233/status/1695465049245241527 · Twitter Post
• https://t.me/pentestingnews/38798 · Telegram Post