Description
Ivanti Sentry MICSLogService存在认证绕过漏洞。此漏洞是由于对传入的数据缺乏校验导致的。
Ivanti Sentry MICSLogService 认证绕过漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_sentry_misc_log_service.rb
https://horizon3.ai/attack-research/attack-blogs/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/
https://www.synacktiv.com/advisories/ivanti-sentry-mobileiron-sentry-unauthenticated-remote-code-execution
https://attackerkb.com/topics/lcHVRCj2l4/cve-2023-38035
https://www.rapid7.com/db/modules/exploit/linux/http/ivanti_sentry_misc_log_service/
https://hub.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035
https://www.ivanti.com/blog/cve-2023-38035-vulnerability-affecting-ivanti-sentry
https://research.splunk.com/deprecated/b8e0d1cf-e6a8-4d46-a5ae-aebe18ead8f8/
https://www.tenable.com/plugins/nessus/180172