CVE-2023-35081

What it actually does

CVE-2023-35081 is an authenticated path traversal vulnerability in Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core. An attacker with administrator-level access can manipulate file path values in appliance requests so that file writes escape the intended directory and place attacker-controlled content elsewhere on the filesystem. Because the target is an appliance that manages mobile devices and sensitive administrative workflows, arbitrary file write can lead to modification of configuration files, deployment of web-accessible scripts, persistence, credential exposure, or full appliance compromise depending on the written path and appliance hardening.

Why it matters to the business

Successful exploitation can give an attacker control over a mobile device management appliance, allowing disruption of mobile management operations, access to sensitive device and user data, unauthorized administrative changes, and potential compromise of enrolled devices or downstream systems that trust the appliance. The vulnerability is listed in CISA KEV, has known active exploitation, and the federal remediation due date of 2023-08-21 has long passed, so unpatched systems should be treated as high-priority exposure even though exploitation requires administrator privileges.

How an attack unfolds

An attacker first obtains valid Ivanti EPMM administrator access, either by credential theft, reuse of exposed credentials, phishing, or by chaining with another vulnerability that provides administrative access. After authenticating to the EPMM administrative interface or API, the attacker submits a crafted request that includes path traversal sequences in a file path, filename, or upload-related parameter. The vulnerable appliance fails to properly constrain the destination path, allowing the write operation to escape the intended directory. The attacker then writes a file to a sensitive location, such as a configuration path, startup/persistence location, administrative content directory, or web-accessible location. If the written file is executable or affects appliance behavior, the attacker may gain code execution, persistence, or the ability to alter appliance operations. They may then enumerate managed devices, harvest credentials or tokens, change policies, issue unauthorized administrative actions, exfiltrate data, and attempt to erase evidence from appliance and proxy logs.

How to fix it

Upgrade Ivanti EPMM to a fixed release: 11.10.x should be upgraded to 11.10.0.3 or later, 11.9.x to 11.9.1.2 or later, and 11.8.x to 11.8.1.2 or later. If the deployed branch is unsupported, migrate to a supported fixed version. Because this vulnerability is in CISA KEV and has active exploitation, prioritize patching internet-accessible and externally administered appliances immediately. Restrict administrative access to trusted networks or VPNs, enforce MFA for administrators, remove unused admin accounts, rotate administrator credentials, and review service accounts and API tokens. If exploitation is suspected, do not rely on patching alone: preserve logs, perform forensic review, rotate secrets, validate appliance integrity, and consider rebuilding the appliance from trusted media or vendor-supported recovery procedures.

How to confirm the fix worked

Confirm the appliance version is at or above the fixed release for its branch: 11.10.0.3+, 11.9.1.2+, or 11.8.1.2+. Validate through the EPMM administrative console, vendor-supported version commands, or authenticated inventory tooling. Confirm that administrative interfaces are not exposed broadly to the internet and are reachable only from approved management networks. Review patch installation logs and appliance restart history to verify the update completed successfully. Where safe and authorized, use a non-destructive authenticated security test to confirm path traversal payloads are rejected and cannot write outside the intended directory. Also verify file integrity monitoring, log forwarding, and administrative audit logging are enabled after remediation.

Typical attack path

1. Obtain valid administrator credentials or administrative access to the Ivanti EPMM appliance.
2. Log in to the EPMM administrative interface or API from an attacker-controlled host.
3. Identify a vulnerable file write function that accepts a user-controllable path or filename.
4. Submit a crafted authenticated request containing path traversal sequences such as ../ or encoded equivalents.
5. Write attacker-controlled content outside the intended directory on the appliance filesystem.
6. Use the written file to alter configuration, establish persistence, expose data, or potentially execute code depending on file placement.
7. Access managed device data, modify MDM policies, harvest secrets, or pivot using trusted appliance access.
8. Remove or tamper with logs and temporary files to reduce forensic visibility.

How to detect it

Review historical telemetry from the EPMM appliance, upstream reverse proxies, WAFs, VPN concentrators, identity providers, and centralized syslog/SIEM. Focus on authenticated administrator sessions from unusual IP addresses, new geographies, unfamiliar user agents, or sessions occurring outside normal maintenance windows. Search HTTP access logs and proxy logs for traversal payloads in authenticated requests, including raw and URL-encoded ../ sequences, double-encoded traversal, and suspicious file upload or file write activity. Correlate these requests with appliance audit events showing administrator login, configuration changes, application or content upload actions, policy changes, or log clearing. On the appliance, review file modification times around suspicious requests and look for newly created or modified web-accessible scripts, configuration files, cron entries, SSH authorized_keys files, startup scripts, or temporary staging files. Investigate unexpected child processes spawned by web or application services, outbound network connections from the appliance to unfamiliar destinations, and signs of credential or token access. Because attackers may chain this issue with credential theft or other Ivanti vulnerabilities, also review identity logs for failed logins, impossible travel, MFA anomalies, and newly created or elevated admin accounts.

• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2E%2E%2F
• ..%252f
• ..%255c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /etc/cron.d/
• /root/.ssh/authorized_keys
• authorized_keys
• crontab
• chmod +x
• wget http
• curl http
• .jsp
• .war
• bash -c
• /bin/sh -c
• nc -e
• python -c
• perl -e

What your security team should do

• Treat unpatched Ivanti EPMM appliances as urgent because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and the remediation deadline has passed.
• Upgrade affected EPMM versions to 11.10.0.3+, 11.9.1.2+, or 11.8.1.2+ immediately, or migrate unsupported deployments to a supported fixed release.
• Restrict EPMM administrative access to trusted management networks and require MFA for all administrator accounts.
• Audit administrator accounts, remove stale users, rotate passwords, and revoke or rotate API tokens and service credentials.
• Review appliance, reverse proxy, WAF, VPN, and identity provider logs for authenticated administrative activity followed by traversal-like requests or suspicious file writes.
• Hunt for unexpected files, modified web content, altered configuration, new SSH keys, cron jobs, startup scripts, or unexplained outbound connections from the appliance.
• If compromise is suspected, isolate the appliance, preserve evidence, engage vendor-supported incident response, rotate secrets, and consider rebuilding from trusted media.