Attack Chain

1. The attacker identifies an Ivanti EPMM server running a vulnerable version (<= 11.4).
2. The attacker sends a crafted HTTP request to the /mifs/aad/api/v2/authorized/users?* endpoint without authentication.
3. The vulnerable EPMM server processes the request without proper authentication checks.
4. The server responds with a 200 OK status code, indicating successful access to the API endpoint.
5. The attacker leverages the unauthorized API access to enumerate authorized users.
6. Using enumerated user information, the attacker gains access to sensitive data and system configurations.
7. The attacker may modify system configurations, install malicious software, or exfiltrate sensitive data.
8. The attacker achieves full system compromise and potentially pivots to other internal systems.

Impact

Successful exploitation of CVE-2023-35078 can have severe consequences, including unauthorized access to sensitive data, modification of system configurations, and potential installation of malware. This can lead to data breaches, financial losses, and reputational damage. While specific victim counts are unavailable in the provided source, the widespread use of Ivanti EPMM suggests a broad potential impact across various sectors. The ability to remotely access and control EPMM servers without authentication makes this a highly critical vulnerability.

Recommendation

• Deploy the provided Sigma rule Detect Ivanti EPMM CVE-2023-35078 API Access to your SIEM to detect unauthorized access attempts to the vulnerable API endpoint.
• Monitor web server logs for HTTP requests to the /mifs/aad/api/v2/authorized/users?* endpoint with a 200 status code, as indicated by the IOC */mifs/aad/api/v2/authorized/users?*.
• Investigate any alerts generated by the Sigma rule or observed suspicious activity in web server logs promptly.
• Refer to the Ivanti advisory (https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US) for patching and mitigation guidance.