Finding a three 0-day exploit chain in Ivanti EPMM and Ivanti Sentry - Tor E. Bjørstad

Описание: This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity #ndcconferences #security #developer #softwaredeveloper

Attend the next NDC conference near you:
https://ndcconferences.com
https://ndc-security.com/

Subscribe to our YouTube channel and learn every day:
/‪@NDC‬

Follow our Social Media!

  / ndcconferences  
  / ndc_conferences  
  / ndc_conferences  


During the summer of 2023, a team at mnemonic discovered three 0-day vulnerabilities in Ivanti Endpoint Protection Manager Mobile (EPMM, formerly known as Mobileiron Core) and Ivanti Sentry.

CVE-2023-35078: authentication bypass in Ivanti EPMM, CVSS 9.8
CVE-2023-35081: path traversal / arbitrary file write in Ivanti EPMM, CVSS 7.2
CVE-2023-38035: authentication bypass in Ivanti Sentry, CVSS 9.8, allowing command execution as root.

All three vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog, as they are known to have been exploited by threat actors in the wild. Ivanti has also confirmed that the vulnerabilities can be combined in an exploit chain.

In this talk we'll take a closer look at what actually happened.