Finding a three 0-day exploit chain in Ivanti EPMM and Ivanti Sentry
summary
Three chained 0-days let attackers move from internet to root on Ivanti appliances: CVE-2023-35078 (auth bypass, CVSS 9.8) exposes REST endpoints by abusing an AAD-prefixed path, then path traversal arbitrary file write (CVE-2023-35081, CVSS 7.2) lets them upload a JSP loader by overwriting the HTTP 415 handler, and a Hessian-RPC flaw in the Sentry mics log service (CVE-2023-38035, CVSS 9.8) executes sudo as root — a Python Hessian PoC successfully runs touch /tmp/rce; vulnerabilities are patched and listed in CISA KEV.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 4:45Ivanti attacks background
- 11:50EPMM and Sentry architecture
- 18:46Zero-day vulnerabilities found
- 21:35Exploit chain breakdown
- 28:19Third vulnerability in Sentry
- 37:19Disclosure and vendor work
- 39:07Lessons from the incident
- 47:17Threat actor techniques
- 49:50Q&A
related talks
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
40mSomething Rotten in the State of Data Centers
55m2024 Security BSides // John Hammond
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
56m"Easy LPEs and Common Software Vulnerabilities"
52mDevSecOps