CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
Description
CVE-2023-38035 is a critical authentication bypass vulnerability in Ivanti MobileIron Sentry (now Ivanti Sentry) versions 9.18.0 and below. The flaw exists in the MICS Admin Portal, where an insufficiently restrictive Apache HTTPD configuration allows an unauthenticated attacker to bypass authentication controls and gain access to the administrative interface. With a CVSS score of 9.8 and an EPSS score of 94.4% indicating near-certain exploitation, CVE-2023-38035 represents an extreme security risk. CISA has confirmed active exploitation in the wild and its use in ransomware campaigns, making immediate remediation of all affected Ivanti Sentry installations essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | mobileiron sentry | <= 9.18.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
CWE-863 describes a weakness where software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In CVE-2023-38035, the Ivanti Sentry MICS Admin Portal relies on an Apache HTTPD configuration that is insufficiently restrictive, allowing attackers to bypass the intended authentication mechanism and access administrative functions without valid credentials.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2023-38035 has a CVSS v3.1 score of 9.8 (Critical), reflecting the maximum practical severity of this authentication bypass vulnerability. The flaw is remotely exploitable over the network with low attack complexity, requiring no authentication or user interaction — making it trivially exploitable by any attacker who can reach the Sentry admin interface. Confidentiality (High): bypassing authentication on the admin portal exposes complete access to Sentry configuration, managed device data, certificates, and potentially enterprise credentials. Integrity (High): an attacker with administrative access can modify security policies, push malicious configurations to managed mobile devices, and alter access control rules across the enterprise mobile infrastructure. Availability (High): full administrative control allows an attacker to disrupt mobile device management services, lock out legitimate administrators, or disable security protections. The EPSS score of 94.4% (99.99th percentile) indicates near-certain exploitation, and CISA has confirmed this vulnerability is actively used in ransomware campaigns, significantly elevating the real-world threat level.
Exploit Maturity
Public exploit code is available for CVE-2023-38035, including an authentication bypass and remote code execution chain published on Packet Storm Security. CISA has confirmed active exploitation in the wild by including this vulnerability in its Known Exploited Vulnerabilities catalog with a remediation deadline of September 12, 2023, and has flagged known ransomware usage associated with this vulnerability. The EPSS score of 94.4% (99.99th percentile) confirms near-certain exploitation activity, reflecting the critical severity, ease of exploitation, and high value of mobile device management infrastructure as a target for both state-sponsored and financially motivated attackers.
Remediation
- Apply Ivanti security patches immediately by upgrading Ivanti Sentry to a version above 9.18.0 that addresses CVE-2023-38035, following the vendor's guidance at the Ivanti forums advisory. If patches are unavailable for your specific version, discontinue use of the product as directed by CISA.
- Restrict network access to the MICS Admin Portal by placing it behind a VPN or management network, ensuring the administrative interface is not accessible from the public internet or untrusted network segments.
- Implement web application firewall (WAF) rules to detect and block unauthorized access attempts to the Sentry administrative interface, particularly requests that attempt to bypass authentication through the misconfigured Apache HTTPD paths.
- Monitor for indicators of compromise by reviewing Sentry server logs for unauthorized administrative access, configuration changes, unexpected API calls, or connections from suspicious IP addresses. Check for signs of ransomware deployment or lateral movement originating from compromised Sentry instances.
- Assess the blast radius by reviewing all mobile devices and enterprise resources managed through the compromised Sentry instance, rotating certificates and credentials that may have been exposed, and evaluating whether managed devices require remediation actions.
Technical Details
CVE-2023-38035 exploits an incorrect authorization weakness (CWE-863) in the MICS Admin Portal of Ivanti MobileIron Sentry. The root cause is an insufficiently restrictive Apache HTTPD configuration that fails to properly enforce authentication requirements on administrative API endpoints. The Apache web server configuration allows certain requests to reach the admin portal backend without passing through the intended authentication layer, effectively providing unauthenticated access to administrative functions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the worst-case exploitability profile: network-accessible, low complexity, no privileges needed, and no user interaction required, with maximum impact across confidentiality, integrity, and availability. The vulnerability is particularly dangerous because Ivanti Sentry serves as a gateway component in enterprise mobile device management architectures, meaning compromise of the admin portal can cascade into control over the entire managed device fleet.
Frequently Asked Questions
Is CVE-2023-38035 being actively exploited?
Yes, CVE-2023-38035 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 12, 2023, and has confirmed its use in ransomware campaigns. The EPSS score of 94.4% (99.99th percentile) indicates near-certain exploitation activity, and public exploit code is readily available.
What products are affected by CVE-2023-38035?
CVE-2023-38035 affects Ivanti MobileIron Sentry (now Ivanti Sentry) versions 9.18.0 and below. The vulnerability is in the MICS Admin Portal component, which provides administrative access to the Sentry gateway used in enterprise mobile device management.
How do I fix CVE-2023-38035?
Upgrade Ivanti Sentry to a patched version above 9.18.0 as recommended by Ivanti's security advisory. If an immediate upgrade is not possible, restrict network access to the MICS Admin Portal and implement WAF rules to block unauthorized authentication bypass attempts. CISA advises discontinuing use if mitigations are unavailable.
How severe is CVE-2023-38035?
CVE-2023-38035 is rated Critical with a CVSS v3.1 score of 9.8 out of 10, the highest practical severity rating. It allows unauthenticated remote access to the administrative interface with no user interaction required. Its confirmed use in ransomware campaigns and an EPSS score in the 99.99th percentile make it one of the most dangerous actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.