From 7fdf0cc2c7d59add02aa37d62802cec20ba11be8 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 31 Jul 2023 13:57:19 -0600 Subject: [PATCH 1/3] Ivanti - CVE-2023-35078 --- ...epmm_remote_unauthenticated_api_access.yml | 58 +++++++++++++++++++ ...nti_epmm_remote_unauthenticated_access.yml | 22 +++++++ 2 files changed, 80 insertions(+) create mode 100644 detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml create mode 100644 stories/ivanti_epmm_remote_unauthenticated_access.yml diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml new file mode 100644 index 0000000000..2e9e7fcee6 --- /dev/null +++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml @@ -0,0 +1,58 @@ +name: Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 +id: 66b9c9ba-7fb2-4e80-a3a2-496e5e078167 +version: 1 +date: '2023-07-31' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic detects the exploitation of CVE-2023-35078, a remote unauthenticated API access vulnerability in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. This vulnerability impacts versions up to 11.4, including releases 11.10, 11.9, and 11.8, as well as older versions. The analytic identifies unauthorized remote access attempts to restricted functionalities or resources within the application without proper authentication. It's detected by monitoring specific API endpoint patterns that should not be accessible without credentials, coupled with unusual access patterns or source locations. This behavior is worth identifying for a Security Operations Center (SOC) as it reveals an active attempt to exploit a known vulnerability to access users' personally identifiable information and make changes to the server. If a true positive is found, it suggests an active exploitation of the vulnerability, potentially leading to data theft, unauthorized modifications, or further system compromise. The impact of the attack, if successfully executed, can be severe, including loss of sensitive information and unauthorized control over affected systems. Immediate action, including patching, is essential to mitigate the risks. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("/mifs/aad/api/v2/authorized/users?*") Web.status=200 + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter`' +how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products. +known_false_positives: False positives may be present if removal of the status=200, as it will alert on 301 and 404's. Hunt for behaviors, but restrict to 200 as it is required in the POC script found. +references: +- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US +- https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py +tags: + analytic_story: + - Ivanti EPMM Remote Unauthenticated Access + asset_type: Web Server + cve: + - CVE-2023-35078 + atomic_guid: [] + confidence: 80 + impact: 80 + message: Potential CVE-2023-35078 against an Ivanti EPMM appliance on $dest$. + mitre_attack_id: + - T1190 + - T1133 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335078.log + source: suricata + sourcetype: suricata + diff --git a/stories/ivanti_epmm_remote_unauthenticated_access.yml b/stories/ivanti_epmm_remote_unauthenticated_access.yml new file mode 100644 index 0000000000..37ba0b3a07 --- /dev/null +++ b/stories/ivanti_epmm_remote_unauthenticated_access.yml @@ -0,0 +1,22 @@ +name: Ivanti EPMM Remote Unauthenticated Access +id: 7e36ca54-c096-4a39-b724-6fc935164f0c +version: 1 +date: '2023-07-31' +author: Michael Haag, Splunk +description: Ivanti, a leading technology company, has disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, CVE-2023-35078 and CVE-2023-35081. The former allows unauthenticated attackers to obtain sensitive data and modify servers, while the latter lets authenticated administrators remotely write arbitrary files to the server. Both vulnerabilities have been exploited in targeted attacks against government ministries and could be used in conjunction. Organizations are urged to apply immediate patches, as the presence of PoC code for CVE-2023-35078 increases the risk of broader exploitation. While currently leveraged in limited attacks, exploitation is likely to rise, possibly involving state-sponsored actors. +narrative: Ivanti's Endpoint Manager Mobile (EPMM) product has been discovered to have two critical zero-day vulnerabilities, CVE-2023-35078 and CVE-2023-35081. The former allows remote unauthenticated attackers to access sensitive data and make changes to servers, and has been exploited in targeted attacks against Norwegian government ministries. Further investigation revealed CVE-2023-35081, a high-severity flaw enabling an authenticated attacker with administrator privileges to remotely write arbitrary files to the server. Notably, these vulnerabilities can be exploited together to bypass admin authentication and access control list (ACL) restrictions, leading to malicious file writing and OS command execution. Both have been actively exploited, possibly by state-sponsored actors, prompting urgent advisories from Ivanti and CISA. EPMM, formerly known as MobileIron Core, is widely used by IT teams to manage mobile devices, applications, and content. With thousands of potentially vulnerable internet-exposed systems and the availability of proof-of-concept code for CVE-2023-35078, the risk of broader exploitation is significant. The situation is further complicated by Ivanti's acquisition of products in 2020 that already had known flaws. These vulnerabilities represent a considerable risk to organizations using Ivanti's EPMM, and prompt patching and careful monitoring are essential to mitigate the threat. +references: +- https://www.securityweek.com/second-ivanti-epmm-zero-day-vulnerability-exploited-in-targeted-attacks/ +- https://www.cisa.gov/news-events/alerts/2023/07/28/ivanti-releases-security-updates-epmm-address-cve-2023-35081 +- https://nvd.nist.gov/vuln/detail/CVE-2023-35078 +- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US +tags: + analytic_story: Ivanti EPMM Remote Unauthenticated Access + category: + - Vulnerability + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 53c98636c33376cd43f2e94227ebb56d120ad166 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 31 Jul 2023 14:20:58 -0600 Subject: [PATCH 2/3] description --- .../web/ivanti_epmm_remote_unauthenticated_api_access.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml index 2e9e7fcee6..f3becafdc2 100644 --- a/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml +++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk status: production type: TTP data_source: [] -description: The following analytic detects the exploitation of CVE-2023-35078, a remote unauthenticated API access vulnerability in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. This vulnerability impacts versions up to 11.4, including releases 11.10, 11.9, and 11.8, as well as older versions. The analytic identifies unauthorized remote access attempts to restricted functionalities or resources within the application without proper authentication. It's detected by monitoring specific API endpoint patterns that should not be accessible without credentials, coupled with unusual access patterns or source locations. This behavior is worth identifying for a Security Operations Center (SOC) as it reveals an active attempt to exploit a known vulnerability to access users' personally identifiable information and make changes to the server. If a true positive is found, it suggests an active exploitation of the vulnerability, potentially leading to data theft, unauthorized modifications, or further system compromise. The impact of the attack, if successfully executed, can be severe, including loss of sensitive information and unauthorized control over affected systems. Immediate action, including patching, is essential to mitigate the risks. +description: The given analytic is designed to detect the exploitation of CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) affecting versions up to 11.4. Specifically, the query searches web logs for HTTP requests to the potentially vulnerable endpoint "/mifs/aad/api/v2/authorized/users?*" with a successful status code of 200. This analytic is instrumental in detecting unauthorized remote access to restricted functionalities or resources within the application, a behavior worth identifying for a Security Operations Center (SOC). By monitoring specific patterns and successful access indicators, it reveals an active attempt to exploit the vulnerability, potentially leading to data theft, unauthorized modifications, or further system compromise. If successfully executed, the impact can be severe, necessitating immediate actions such as patching to mitigate the risks. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/mifs/aad/api/v2/authorized/users?*") Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype From fb4c626c747efb27f72ac317052c831cc8c7e859 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 31 Jul 2023 14:25:44 -0700 Subject: [PATCH 3/3] Update ivanti_epmm_remote_unauthenticated_api_access.yml minor changes to free text fields --- .../web/ivanti_epmm_remote_unauthenticated_api_access.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml index f3becafdc2..652de49276 100644 --- a/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml +++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk status: production type: TTP data_source: [] -description: The given analytic is designed to detect the exploitation of CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) affecting versions up to 11.4. Specifically, the query searches web logs for HTTP requests to the potentially vulnerable endpoint "/mifs/aad/api/v2/authorized/users?*" with a successful status code of 200. This analytic is instrumental in detecting unauthorized remote access to restricted functionalities or resources within the application, a behavior worth identifying for a Security Operations Center (SOC). By monitoring specific patterns and successful access indicators, it reveals an active attempt to exploit the vulnerability, potentially leading to data theft, unauthorized modifications, or further system compromise. If successfully executed, the impact can be severe, necessitating immediate actions such as patching to mitigate the risks. +description: The given analytic is designed to detect the exploitation of CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) affecting versions up to 11.4. Specifically, the query searches web logs for HTTP requests to the potentially vulnerable endpoint "/mifs/aad/api/v2/authorized/users?*" with a successful status code of 200. This analytic is instrumental in detecting unauthorized remote access to restricted functionalities or resources within the application, a behavior worth identifying for a Security Operations Center (SOC). By monitoring specific patterns and successful access indicators, it reveals an active attempt to exploit the vulnerability, potentially leading to data theft, unauthorized modifications, or further system compromise. If successfully executed, the impact can be severe, necessitating immediate action. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/mifs/aad/api/v2/authorized/users?*") Web.status=200 by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype @@ -14,7 +14,7 @@ search: '| tstats count min(_time) as firstTime max(_time) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter`' how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products. -known_false_positives: False positives may be present if removal of the status=200, as it will alert on 301 and 404's. Hunt for behaviors, but restrict to 200 as it is required in the POC script found. +known_false_positives: The Proof of Concept exploit script indicates that status=200 is required for successful exploitation of the vulnerability. False positives may be present if status=200 is removed from the search. If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts. Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability. references: - https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US - https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py