CVE-2023-35078: Ivanti EPMM Auth Bypass Vulnerability

CVE-2023-35078 Overview

CVE-2023-35078 is a critical authentication bypass vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. This vulnerability allows remote unauthenticated attackers to access restricted API endpoints without proper authentication, potentially leading to unauthorized access to sensitive data and administrative functions. The flaw resides in the API authentication mechanism, enabling attackers to bypass security controls and interact with the application as if they were authenticated users.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations using Ivanti EPMM should treat this as a high-priority security incident requiring immediate remediation.

Affected Products

• Ivanti Endpoint Manager Mobile (EPMM) - multiple versions
• Ivanti Endpoint Manager Mobile (formerly MobileIron Core)
• Ivanti EPMM on-premises deployments

Discovery Timeline

• 2023-07-25 - CVE-2023-35078 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2023-35078

Vulnerability Analysis

CVE-2023-35078 is classified under CWE-287 (Improper Authentication), representing a fundamental flaw in how the Ivanti EPMM application validates user identity before granting access to protected resources. The vulnerability allows unauthenticated remote attackers to access API endpoints that should require proper authentication credentials.

The exploitation of this vulnerability requires no user interaction and can be performed remotely over the network. Attackers do not need any prior privileges or authentication to exploit this flaw, making it particularly dangerous for internet-facing EPMM deployments. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability has been observed being actively exploited in targeted attacks, prompting CISA to add it to their Known Exploited Vulnerabilities catalog and issue an emergency directive for federal agencies to remediate.

Root Cause

The root cause of CVE-2023-35078 lies in improper authentication validation within the Ivanti EPMM API endpoints. The application fails to properly enforce authentication checks on certain API paths, allowing unauthenticated requests to be processed as if they originated from legitimate authenticated sessions. This authentication bypass occurs due to insufficient validation of incoming requests before granting access to sensitive functionality.

Attack Vector

The attack vector for this vulnerability is network-based, specifically targeting the web-based API interface of Ivanti EPMM. Attackers can craft specially formatted HTTP requests to access restricted API endpoints without providing valid authentication credentials.

Exploitation typically involves:

1. Identifying an internet-accessible Ivanti EPMM instance
2. Sending crafted requests to vulnerable API endpoints
3. Bypassing authentication controls to access administrative functions
4. Extracting sensitive data or performing unauthorized administrative actions

The vulnerability allows attackers to access personally identifiable information (PII), add administrative accounts, or make configuration changes to managed mobile devices within the enterprise environment.

Detection Methods for CVE-2023-35078

Indicators of Compromise

• Unusual API access patterns from external IP addresses without corresponding authentication events
• Unexpected administrative account creation or configuration changes in EPMM
• Anomalous data extraction or bulk queries to the EPMM API
• Access to API endpoints typically reserved for authenticated administrative users from unauthenticated sessions

Detection Strategies

• Monitor web server and application logs for API requests to sensitive endpoints without valid session tokens
• Implement network-level detection rules for unusual traffic patterns to EPMM servers
• Deploy web application firewalls (WAF) with rules to detect authentication bypass attempts
• Review EPMM audit logs for unauthorized administrative actions or data access

Monitoring Recommendations

• Enable comprehensive logging on all Ivanti EPMM instances, including API access logs
• Implement real-time alerting for failed authentication attempts followed by successful API access
• Monitor network traffic for connections to EPMM from suspicious or unexpected IP ranges
• Establish baseline normal API usage patterns and alert on deviations

How to Mitigate CVE-2023-35078

Immediate Actions Required

• Apply the security patch from Ivanti immediately for all affected EPMM deployments
• Restrict network access to EPMM management interfaces to trusted IP ranges only
• Review EPMM audit logs for any signs of exploitation or unauthorized access
• Consider temporarily taking EPMM offline if patching cannot be performed immediately

Patch Information

Ivanti has released security updates to address this vulnerability. Organizations should consult the Ivanti Security Advisory for specific version information and patch downloads. CISA has also issued guidance available in their security alert.

Due to the critical nature of this vulnerability and confirmed active exploitation, immediate patching is strongly recommended. Federal agencies are required to address this vulnerability per CISA's emergency directive.

Workarounds

• Place Ivanti EPMM behind a VPN or other network access control to limit exposure
• Implement strict firewall rules to allow access only from authorized administrative IP addresses
• Enable additional authentication layers such as client certificates where supported
• Monitor for and block suspicious API traffic patterns at the network perimeter

# Example: Restrict EPMM access using firewall rules
# Allow access only from trusted administrative networks
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify EPMM is not directly exposed to the internet
# Check listening services and ensure proper network segmentation
netstat -tlnp | grep -E ":(443|8443)"