diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml new file mode 100644 index 0000000000..652de49276 --- /dev/null +++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml @@ -0,0 +1,58 @@ +name: Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 +id: 66b9c9ba-7fb2-4e80-a3a2-496e5e078167 +version: 1 +date: '2023-07-31' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: The given analytic is designed to detect the exploitation of CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) affecting versions up to 11.4. Specifically, the query searches web logs for HTTP requests to the potentially vulnerable endpoint "/mifs/aad/api/v2/authorized/users?*" with a successful status code of 200. This analytic is instrumental in detecting unauthorized remote access to restricted functionalities or resources within the application, a behavior worth identifying for a Security Operations Center (SOC). By monitoring specific patterns and successful access indicators, it reveals an active attempt to exploit the vulnerability, potentially leading to data theft, unauthorized modifications, or further system compromise. If successfully executed, the impact can be severe, necessitating immediate action. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("/mifs/aad/api/v2/authorized/users?*") Web.status=200 + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter`' +how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products. +known_false_positives: The Proof of Concept exploit script indicates that status=200 is required for successful exploitation of the vulnerability. False positives may be present if status=200 is removed from the search. If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts. Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability. +references: +- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US +- https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py +tags: + analytic_story: + - Ivanti EPMM Remote Unauthenticated Access + asset_type: Web Server + cve: + - CVE-2023-35078 + atomic_guid: [] + confidence: 80 + impact: 80 + message: Potential CVE-2023-35078 against an Ivanti EPMM appliance on $dest$. + mitre_attack_id: + - T1190 + - T1133 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335078.log + source: suricata + sourcetype: suricata + diff --git a/stories/ivanti_epmm_remote_unauthenticated_access.yml b/stories/ivanti_epmm_remote_unauthenticated_access.yml new file mode 100644 index 0000000000..37ba0b3a07 --- /dev/null +++ b/stories/ivanti_epmm_remote_unauthenticated_access.yml @@ -0,0 +1,22 @@ +name: Ivanti EPMM Remote Unauthenticated Access +id: 7e36ca54-c096-4a39-b724-6fc935164f0c +version: 1 +date: '2023-07-31' +author: Michael Haag, Splunk +description: Ivanti, a leading technology company, has disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, CVE-2023-35078 and CVE-2023-35081. The former allows unauthenticated attackers to obtain sensitive data and modify servers, while the latter lets authenticated administrators remotely write arbitrary files to the server. Both vulnerabilities have been exploited in targeted attacks against government ministries and could be used in conjunction. Organizations are urged to apply immediate patches, as the presence of PoC code for CVE-2023-35078 increases the risk of broader exploitation. While currently leveraged in limited attacks, exploitation is likely to rise, possibly involving state-sponsored actors. +narrative: Ivanti's Endpoint Manager Mobile (EPMM) product has been discovered to have two critical zero-day vulnerabilities, CVE-2023-35078 and CVE-2023-35081. The former allows remote unauthenticated attackers to access sensitive data and make changes to servers, and has been exploited in targeted attacks against Norwegian government ministries. Further investigation revealed CVE-2023-35081, a high-severity flaw enabling an authenticated attacker with administrator privileges to remotely write arbitrary files to the server. Notably, these vulnerabilities can be exploited together to bypass admin authentication and access control list (ACL) restrictions, leading to malicious file writing and OS command execution. Both have been actively exploited, possibly by state-sponsored actors, prompting urgent advisories from Ivanti and CISA. EPMM, formerly known as MobileIron Core, is widely used by IT teams to manage mobile devices, applications, and content. With thousands of potentially vulnerable internet-exposed systems and the availability of proof-of-concept code for CVE-2023-35078, the risk of broader exploitation is significant. The situation is further complicated by Ivanti's acquisition of products in 2020 that already had known flaws. These vulnerabilities represent a considerable risk to organizations using Ivanti's EPMM, and prompt patching and careful monitoring are essential to mitigate the threat. +references: +- https://www.securityweek.com/second-ivanti-epmm-zero-day-vulnerability-exploited-in-targeted-attacks/ +- https://www.cisa.gov/news-events/alerts/2023/07/28/ivanti-releases-security-updates-epmm-address-cve-2023-35081 +- https://nvd.nist.gov/vuln/detail/CVE-2023-35078 +- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US +tags: + analytic_story: Ivanti EPMM Remote Unauthenticated Access + category: + - Vulnerability + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection