MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier contain a vulnerability that allows remote attackers to execute arbitrary code via unspecified vectors.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the MobileIron infrastructure.

Fix

Upgrade MobileIron Core & Connector and Sentry to versions above v10.6 & v9.8 respectively

How to confirm it

Send: POST /mifs/.;/services/LogService
Positive when: contains in header "application/x-hessian" AND status 200

Run it with nuclei: nuclei -id CVE-2020-15505 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-15505

# THIS TEMPLATE IS ONLY FOR DETECTING
# To carry out further attacks, please see reference[2] below.
# This template works by passing a Hessian header, otherwise;
# it will return a 403 or 500 internal server error. Reference[3].
info:
  name: MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier contain a vulnerability that allows remote attackers to execute arbitrary code via unspecified vectors.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the MobileIron infrastructure.
  remediation: |
    Upgrade MobileIron Core & Connector and Sentry to versions above v10.6 & v9.8 respectively
  reference:
    - https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
    - https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
    - https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
    - https://github.com/orangetw/JNDI-Injection-Bypass
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15505
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-15505
    cwe-id: CWE-706
    epss-score: 0.99737
    epss-percentile: 0.99953
    cpe: cpe:2.3:a:mobileiron:core:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mobileiron
    product: core
  tags: cve,cve2020,mobileiron,rce,sentry,kev,vkev,vuln

http:
  - raw:
      - |
        POST /mifs/.;/services/LogService HTTP/1.1
        Host: {{Hostname}}
        Referer: https://{{Hostname}}
        Content-Type: x-application/hessian
        Connection: close

        {{hex_decode('630200480004')}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/x-hessian"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from