CVE-2023-35080: Ivanti Secure Access Privilege Escalation

CVE-2023-35080 Overview

A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service, or information disclosure. This vulnerability stems from improper default permissions (CWE-276) in the affected software component.

Critical Impact

Local attackers with low privileges can exploit this vulnerability to achieve privilege escalation, denial of service, or information disclosure on affected Windows systems running the Ivanti Secure Access Client.

Affected Products

• Ivanti Secure Access Client (all versions prior to patched release)
• Ivanti Secure Access Client version 22.6 R1
• Microsoft Windows (as the operating system platform)

Discovery Timeline

• 2023-11-15 - CVE-2023-35080 published to NVD
• 2025-01-07 - Last updated in NVD database

Technical Details for CVE-2023-35080

Vulnerability Analysis

This vulnerability affects the Ivanti Secure Access Windows client and is classified under CWE-276 (Incorrect Default Permissions). The flaw allows locally authenticated attackers to exploit misconfigured permissions within the client application. The vulnerability requires local access and low privileges to exploit, but does not require user interaction. A successful attack can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

The attack surface is limited to local access, meaning an attacker must already have some level of access to the target system. However, once exploited, the impact is significant as the attacker can escalate their privileges, potentially gaining administrative control over the system, disrupting services, or accessing sensitive information.

Root Cause

The root cause of CVE-2023-35080 is incorrect default permissions (CWE-276) within the Ivanti Secure Access Windows client. When installed, the client software creates files, directories, or registry entries with overly permissive access controls. This configuration weakness allows low-privileged users to modify critical components or configurations that should only be accessible to administrators or the SYSTEM account.

Incorrect default permissions are a common issue in Windows software installations where developers may not adequately restrict access to application directories, configuration files, or service executables. Attackers can leverage these misconfigurations to inject malicious code, alter application behavior, or access sensitive data stored by the application.

Attack Vector

The attack requires local access to a Windows system with the vulnerable Ivanti Secure Access Client installed. An attacker with low-level privileges on the system can identify and exploit the misconfigured permissions. The attack vector involves:

1. Identifying vulnerable files, directories, or configurations with incorrect permissions
2. Modifying these resources to inject malicious code or alter configurations
3. Triggering the execution of the modified components through normal application operation or system restart
4. Achieving elevated privileges, causing service disruption, or accessing protected information

The vulnerability does not require user interaction, making it particularly dangerous in environments where multiple users share access to the same system or where an attacker has gained initial foothold through other means.

Detection Methods for CVE-2023-35080

Indicators of Compromise

• Unexpected modifications to Ivanti Secure Access Client installation directories or files
• Changes to file permissions on the Ivanti Secure Access Client components
• Unauthorized registry modifications related to the Ivanti Secure Access Client service
• Unusual process execution originating from Ivanti Secure Access Client directories

Detection Strategies

• Monitor Windows Security Event Logs for permission changes on Ivanti Secure Access Client directories using Event ID 4670
• Implement file integrity monitoring (FIM) on the Ivanti Secure Access Client installation path
• Track process creation events from the Ivanti Secure Access Client directory for anomalous child processes
• Audit service configuration changes for the Ivanti Secure Access Client service

Monitoring Recommendations

• Enable verbose logging for the Ivanti Secure Access Client application
• Configure SIEM rules to alert on privilege escalation patterns from low-privileged users
• Monitor for unexpected service restarts or configuration changes to the Ivanti Secure Access Client
• Implement endpoint detection and response (EDR) policies to detect exploitation attempts

How to Mitigate CVE-2023-35080

Immediate Actions Required

• Update to the latest patched version of Ivanti Secure Access Client as described in the Ivanti Security Advisory
• Audit current file and directory permissions for the Ivanti Secure Access Client installation
• Restrict local user access to systems running the vulnerable client where possible
• Monitor systems for exploitation attempts while patching is in progress

Patch Information

Ivanti has released security fixes in the latest Ivanti Secure Access Client release. Organizations should review the official Ivanti Security Advisory for detailed patch information and upgrade instructions. The patch addresses the incorrect default permissions issue by implementing proper access controls on affected components.

Workarounds

• Manually restrict permissions on the Ivanti Secure Access Client installation directory to administrators only
• Implement application whitelisting to prevent unauthorized executables from running in the client directory
• Use Windows Software Restriction Policies or AppLocker to limit execution from vulnerable paths
• Limit local user access to affected systems until patching can be completed

# Example: Restrict permissions on Ivanti Secure Access Client directory (PowerShell)
# Verify the installation path before applying
$installPath = "C:\Program Files\Ivanti\Secure Access Client"
icacls $installPath /inheritance:r
icacls $installPath /grant:r "SYSTEM:(OI)(CI)F"
icacls $installPath /grant:r "Administrators:(OI)(CI)F"
icacls $installPath /grant:r "Users:(OI)(CI)RX"