CVE-2020-15505
Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability
Description
CVE-2020-15505 is a CRITICAL remote code execution vulnerability in multiple Ivanti MobileIron products, carrying a CVSS 3.1 score of 9.8. The vulnerability affects MobileIron Core & Connector (versions 10.3.0.3 and earlier, 10.4.x, 10.5.x, 10.6.0.0), Sentry (versions 9.7.2 and earlier, 9.8.0), and Monitor and Reporting Database (version 2.0.0.1 and earlier). Classified under CWE-706, this flaw allows unauthenticated remote attackers to execute arbitrary code via unspecified vectors. No authentication and no user interaction are required, making this trivially exploitable. CISA added CVE-2020-15505 to its KEV catalog on November 3, 2021. The EPSS score of 0.94330 (99.95th percentile) indicates an extremely high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| mobileiron | core | < 10.3.0.4; >= 10.4.0.0, < 10.4.0.4; >= 10.5.1.0, < 10.5.1.1; >= 10.5.2.0, < 10.5.2.1; >= 10.6.0.0, < 10.6.0.1 |
| mobileiron | enterprise connector | < 10.3.0.4; >= 10.4.0.0, < 10.4.0.4; >= 10.5.1.0, < 10.5.1.1; >= 10.5.2.0, < 10.5.2.1; >= 10.6.0.0, < 10.6.0.1 |
| mobileiron | monitor and reporting database | < 2.0.0.2 |
| mobileiron | sentry | >= 9.7.0, < 9.7.3; >= 9.8.0, < 9.8.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161097/MobileIron-MDM-Hessian-Based-Java-Deserialization-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://cwe.mitre.org/data/definitions/41.html(Third Party Advisory)
- https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/(Exploit, Third Party Advisory)
- https://www.mobileiron.com/en/blog/mobileiron-security-updates-available(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15505(US Government Resource)
Weakness Type
CWE-706: Use of Incorrectly-Resolved Name or Reference
Use of Incorrectly-Resolved Name or Reference occurs when a product uses a name or reference to access a resource, but that name resolves to a resource outside of the intended control sphere. This allows attackers to manipulate how references are resolved, causing the application to load or execute resources controlled by the attacker instead of legitimate resources.
In the context of CVE-2020-15505, the Ivanti MobileIron products contain a vulnerability related to how certain resource references or names are resolved during request processing. Attackers exploit this incorrect resolution mechanism to inject and execute arbitrary code on the server. The Hessian-based Java deserialization mechanism in MobileIron has been identified as a key attack vector, where improperly resolved class references during deserialization allow attackers to instantiate malicious objects, leading to remote code execution with the privileges of the MobileIron application.
Learn more: CWE-706 — Use of Incorrectly-Resolved Name or Reference
Impact Analysis
CVE-2020-15505 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker full access to the MobileIron server, exposing all managed mobile device data including device configurations, corporate email, enterprise application data, VPN credentials, certificates, and user information for all enrolled devices. MobileIron MDM servers typically manage thousands of enterprise mobile devices.
Integrity (HIGH): With code execution on the MDM server, attackers can modify device policies, push malicious configurations to enrolled devices, install unauthorized applications on managed devices, alter compliance policies, and tamper with audit logs. The ability to push configurations to enrolled devices significantly amplifies the integrity impact.
Availability (HIGH): Attackers can completely disable the mobile device management service, disrupt device enrollment and policy enforcement, prevent security updates from reaching managed devices, and render the entire MDM infrastructure inoperable.
Scope Unchanged: While the CVSS scope is Unchanged, the practical impact extends far beyond the MobileIron server itself. A compromised MDM server provides the attacker with control over all enrolled mobile devices and access to sensitive enterprise data flowing through the platform.
With an EPSS score of 0.94330 (99.95th percentile), this vulnerability ranks in the top 0.05% of all CVEs for exploitation probability.
Exploit Maturity
CVE-2020-15505 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is actively exploited by multiple threat actor groups, including nation-state actors. A complete remote code execution exploit leveraging Hessian-based Java deserialization is publicly available through Packet Storm Security. The exploit requires no authentication, making any internet-exposed MobileIron instance immediately vulnerable.
Ransomware association: As of the latest KEV data, no direct ransomware campaign has been publicly attributed to CVE-2020-15505. However, the unauthenticated RCE capability and the high value of MDM infrastructure make it an attractive target for ransomware operators.
Attack surface: Ivanti MobileIron products are widely deployed across enterprises, government agencies, and organizations that manage corporate mobile devices. MDM servers are frequently internet-accessible to support remote device enrollment and management, significantly expanding the attack surface. APT groups have been documented targeting MobileIron vulnerabilities for espionage and network access.
KEV deadline: CISA required federal agencies to remediate this vulnerability by May 3, 2022. The EPSS score of 0.94330 (99.95th percentile) and confirmed APT exploitation underscore the critical urgency.
Remediation
- Apply Ivanti MobileIron patches immediately. Update all MobileIron Core, Connector, Sentry, and Monitor and Reporting Database instances to the latest patched versions. Consult the MobileIron security advisory for specific version guidance.
- Restrict network access to MobileIron management interfaces. While the device management ports may need to remain accessible, restrict administrative interface access to trusted networks. Implement IP-based access controls and consider placing management interfaces behind a VPN.
- Scan for indicators of compromise immediately. Given the confirmed active exploitation by advanced threat actors, conduct a thorough forensic investigation of all MobileIron servers. Check for unauthorized processes, unexpected network connections, modified files, new user accounts, and evidence of lateral movement.
- Review managed device configurations and policies. After patching, audit all device policies, configuration profiles, and enrolled applications for unauthorized changes. Verify that no malicious profiles have been pushed to managed devices.
- Implement enhanced monitoring for MobileIron infrastructure. Deploy network monitoring, log aggregation, and intrusion detection specifically focused on MobileIron traffic patterns. Monitor for unusual API calls, configuration changes, and enrollment activities.
- Assess the need for server rebuild. If there is any evidence of compromise, consider performing a complete rebuild of the MobileIron server from trusted media rather than relying solely on patching, as advanced attackers may have established persistent access mechanisms.
Technical Details
CVE-2020-15505 is a CRITICAL-severity vulnerability in multiple Ivanti MobileIron products that can be exploited remotely over the network without any authentication or user interaction. The attack complexity is low, requiring no specialized conditions.
Technical mechanism: MobileIron Core and related products expose web services that process serialized Java objects using the Hessian serialization protocol. The vulnerability exists in how the application resolves class references during the deserialization of incoming requests. An attacker can craft a malicious Hessian-serialized payload containing references to dangerous Java classes that, when deserialized, trigger arbitrary code execution on the server. The deserialization occurs before any authentication check, allowing completely unauthenticated exploitation. The malicious payload executes with the privileges of the MobileIron application process.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents the most dangerous exploitation profile: network-accessible with low complexity, no authentication, and no user interaction required. The triple-HIGH impact ratings across Confidentiality, Integrity, and Availability reflect complete system compromise capability. The exploitability score of 3.9 (maximum) confirms the trivial nature of exploitation.
Frequently Asked Questions
Is CVE-2020-15505 being actively exploited?
Yes, CVE-2020-15505 is actively exploited in the wild by multiple threat actor groups including nation-state actors. It is listed in CISA's KEV catalog. The EPSS score of 0.94330 (99.95th percentile) places it among the most exploited vulnerabilities. Public exploit code for Hessian-based Java deserialization RCE is available.
What products are affected by CVE-2020-15505?
Affected products include MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0 through 10.4.0.3, 10.5.1.0, 10.5.2.0, and 10.6.0.0; Sentry versions 9.7.2 and earlier and 9.8.0; and Monitor and Reporting Database version 2.0.0.1 and earlier. These products are now under the Ivanti brand.
How do I fix CVE-2020-15505?
Apply updates per vendor instructions from Ivanti's security advisory. Update MobileIron Core, Connector, Sentry, and RDB to patched versions. Restrict administrative interface access, conduct forensic investigation for signs of compromise, and review all managed device policies for unauthorized changes.
How severe is CVE-2020-15505?
CVE-2020-15505 is rated CRITICAL with a CVSS 3.1 score of 9.8, the near-maximum severity. The vulnerability requires no authentication and no user interaction, allowing any network-accessible attacker to gain remote code execution on the MobileIron server. Compromising an MDM server provides control over all managed mobile devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.