CVE-2023-38035

What it actually does

CVE-2023-38035 is an unauthenticated authorization bypass in the Ivanti MobileIron Sentry MICS Admin Portal caused by an overly permissive Apache HTTPD configuration. A remote attacker with network access to the administrative interface can bypass expected authentication controls and reach administrative functions. Successful exploitation can allow full compromise of the Sentry appliance, including configuration tampering, access to sensitive data handled by the gateway, and potential command execution or file modification depending on exposed administrative functionality.

Why it matters to the business

This vulnerability can let an unauthenticated attacker take control of an Ivanti MobileIron Sentry appliance that protects mobile and enterprise traffic. Because the issue has a CVSS score of 9.8, an EPSS score near 1.0, is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware activity, exposed systems should be treated as high-priority incident response cases rather than routine patching. Compromise could disrupt mobile access, expose sensitive traffic or configuration data, enable attacker persistence at a network choke point, and create a foothold for broader enterprise intrusion.

How an attack unfolds

An attacker first identifies an Ivanti MobileIron Sentry appliance with the MICS Admin Portal reachable over the network, commonly by scanning for the administrative service and related HTTPS endpoints. Because the Apache HTTPD configuration does not sufficiently restrict access, the attacker sends crafted requests directly to administrative MICS paths that should require trusted or authenticated access. If successful, the attacker reaches management functionality without valid credentials. From there, they may review or alter configuration, attempt to execute privileged administrative actions, write files, deploy persistence, collect sensitive appliance data, or use the compromised Sentry system as an entry point for lateral movement. Since this vulnerability is in CISA KEV, has active exploitation, and is flagged as used in ransomware campaigns, exploitation should be assumed plausible for any internet- or broadly network-exposed affected appliance.

How to fix it

Upgrade or apply the Ivanti-provided remediation for MobileIron Sentry immediately. Ivanti MobileIron Sentry versions 9.18.0 and below are affected. Where a version upgrade is not available or practical, apply the vendor-supplied RPM/hotfix or configuration remediation for the MICS Admin Portal as directed by Ivanti. Restrict access to Sentry administrative interfaces, especially the MICS Admin Portal, to trusted management networks only. Block internet exposure of administrative ports at firewalls, load balancers, VPN policies, and security groups. Rotate administrative credentials and relevant secrets after remediation if exposure or exploitation is suspected. Because this vulnerability is KEV-listed with a CISA due date of 2023-09-12 and is associated with ransomware activity, organizations should prioritize remediation immediately and perform compromise assessment on any exposed appliance.

How to confirm the fix worked

Confirm the appliance is no longer running an affected MobileIron Sentry version or that the Ivanti remediation package has been applied successfully. Validate that the MICS Admin Portal is not reachable from the internet or untrusted networks. From an unauthenticated test system, attempt to reach known MICS administrative paths and verify that access is denied, redirected to authentication, or blocked by network controls. Review Apache HTTPD configuration and access-control rules to ensure administrative locations are restricted to intended trusted sources. Confirm firewall and ACL rules limit administrative access to approved management IP ranges. Review vendor logs and package inventory to verify the hotfix or updated configuration survived reboot and service restart.

Typical attack path

1. Scan for Ivanti MobileIron Sentry appliances and exposed administrative HTTPS services.
2. Probe the MICS Admin Portal and related administrative paths for unauthenticated access.
3. Exploit the Apache HTTPD access-control weakness to bypass authentication checks.
4. Access administrative functionality that should only be available to trusted authenticated management components.
5. Modify appliance configuration, retrieve sensitive information, or perform privileged actions.
6. Attempt to establish persistence, stage files, execute commands, or pivot deeper into the network.
7. Cover tracks by deleting files, altering logs, or blending activity into normal administrative traffic.

How to detect it

Review network, reverse proxy, firewall, VPN, Apache HTTPD, and appliance application logs for access to the MICS Admin Portal from untrusted or unusual source IP addresses. Focus on HTTPS administrative traffic, especially requests to MICS-related paths that succeed without a prior authenticated session. Hunt for spikes in 200, 302, 401, 403, or 500 responses involving MICS endpoints, repeated probing of administrative URLs, requests with unusual user agents, and access from scanning infrastructure. On the appliance, review Apache access and error logs, Ivanti/Sentry application logs, shell history where available, package installation records, recently modified files, unexpected web-accessible files, and new or modified cron/systemd entries. Look for suspicious processes spawned by web or application service accounts, outbound connections from the appliance to unfamiliar hosts, and configuration changes made outside approved maintenance windows. Because exploitation is known in the wild and associated with ransomware activity, detection should include both initial access indicators and post-exploitation behaviors such as web shell placement, credential theft, persistence, and lateral movement attempts.

• /mics
• /mics/
• /mics/services
• /mics/services/
• MICS Admin Portal
• MobileIron Sentry
• Ivanti Sentry
• GET /mics
• POST /mics
• GET /mics/
• POST /mics/
• GET /mics/services
• POST /mics/services
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/httpd/ssl_access_log
• /var/log/httpd/ssl_error_log
• httpd
• apache
• curl/
• python-requests
• wget/

What your security team should do

• Immediately identify all Ivanti MobileIron Sentry appliances and determine whether any are version 9.18.0 or below.
• Treat any affected appliance with an exposed administrative interface as potentially compromised until logs and filesystem artifacts are reviewed.
• Apply the Ivanti remediation or upgrade path immediately; do not rely only on monitoring for protection.
• Restrict MICS Admin Portal and other administrative services to trusted management networks and block direct internet access.
• Perform retrospective threat hunting for unauthenticated requests to MICS administrative paths, especially from unknown external IP addresses.
• Collect and preserve appliance logs before rebooting or rebuilding systems if compromise is suspected.
• Rotate administrative credentials, API secrets, certificates, and integration credentials associated with affected appliances after remediation where exposure is possible.
• Look for web shells, unexpected files, suspicious child processes spawned by web or application services, and unauthorized configuration changes.
• If exploitation is confirmed, rebuild the appliance from trusted media and investigate adjacent systems for lateral movement.
• Track Ivanti advisories and CISA KEV guidance because this vulnerability has active exploitation and ransomware relevance.