Ivanti EPMM/MobileIron CVE-2023-35082: Unauth API Access

What to do

1. Find every on-premises MobileIron Core and EPMM server and record its version.
2. Upgrade to a current EPMM release; on 11.3 to 11.10, apply Ivanti's RPM script only as a stopgap.
3. Retire MobileIron Core 11.2 and older, or take it off the internet until it is replaced; Ivanti will not fix it.
4. From an internal host, check that curl -k https://<epmm-host>/mifs/asfV3/api/v2/ping returns 401 or 403, not JSON.
5. Hunt the Apache logs for the request paths below; if you find hits, rebuild the server and rotate the credentials it holds.

How to check if you are affected or compromised

• grep /var/log/httpd/http-access_log for /mifs/asfV3/api/v2/ requests with HTTP 200 responses; 401 or 403 means the attempt was blocked.
• Check /var/log/httpd/http-request_log for the same path.
• Also search for /mifs/aad/api/v2/, the path used to exploit the related CVE-2023-35078.
• Look for unexpected files on the appliance, since chaining with CVE-2023-35081 can write web shells.

What happened#

In July 2023, CISA put CVE-2023-35078, an unauthenticated API access flaw in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), in its exploited-vulnerabilities catalog. While testing Ivanti's hotfix for it, Stephen Fewer of Rapid7 found a way around the fix and reported it on July 26. Ivanti and Rapid7 disclosed it as CVE-2023-35082 on August 2, 2023. The hotfix blocks unauthenticated requests under /mifs/aad/api/v2/, but the same requests still work under /mifs/asfV3/api/v2/. Rapid7 traced both to overly permissive entries in the mifs security filter chain. An attacker can call the API to read personal data and make changes to the server. Chained with CVE-2023-35081, it can write a web shell.

Ivanti's advisory first said only Core 11.2 and older were affected, because the bug was "incidentally resolved" in 11.3. Then Florian Hauser of CODE WHITE found EPMM 11.10 vulnerable in a specific configuration. On August 7, Ivanti widened the scope to EPMM 11.8 to 11.10 and Core 11.7 and below, and shipped an RPM script for 11.3 to 11.10. EPMM 11.11.0.0 fixed it on August 21. Ivanti scores it 10.0; NVD gives 9.8.

CISA added it to KEV on January 18, 2024, five months later, without describing the attacks. Ivanti's knowledge base had already said in August 2023 that "a few customers" were exploited after Rapid7 published details, as Help Net Security reported. CISA's catalog now marks the bug as known to be used in ransomware campaigns, without naming a group.

Who is affected#

On-premises MobileIron Core 11.7 and earlier and EPMM 11.8, 11.9 and 11.10, according to Ivanti and the CVE record. Core 11.2 has been out of support since March 15, 2022. Ivanti says it will not issue an RPM script or any other fix for 11.2 or earlier, so upgrading is the only remedy.

Do you really need to act?#

Not if you run EPMM 11.11 or later, which covers every release since August 2023. Worry about stragglers: an MDM box nobody upgraded, especially Core 11.2 or older, which cannot be fixed. It holds device inventories and user data, can push configuration to phones, and the bug needs only network access. If one is still running, upgrade it or take it offline. For the EPMM bugs that matter on current releases, see our brief on CVE-2026-1281 and CVE-2026-1340.

What to do now#

1. Inventory every MobileIron Core and EPMM server and its version.
2. Upgrade to a current EPMM release. On 11.3 to 11.10, Ivanti's RPM script is a stopgap; versions older than 11.3 must reach 11.10 before it applies.
3. Retire MobileIron Core 11.2 and older, or cut it off from the internet until it is replaced.
4. From an internal host, run Rapid7's check: curl -k https://<epmm-host>/mifs/asfV3/api/v2/ping. A JSON reply with apiVersion means unauthenticated access works. HTTP 401 or 403 means it is blocked.

How to tell if you were hit#

Rapid7 lists indicators in the appliance's Apache logs. In /var/log/httpd/http-access_log, a request containing /mifs/asfV3/api/v2/ with response code 200 is a successful exploit; 401 or 403 means it was blocked. The same path appears in /var/log/httpd/http-request_log. Run grep '/mifs/asfV3/api/v2/' /var/log/httpd/http-access_log*, then repeat for /mifs/aad/api/v2/, the CVE-2023-35078 path. Because CVE-2023-35081 can be chained to write files, look for unfamiliar files too. If you find hits, rebuild the server and rotate the directory, certificate and API credentials it stores.

Timeline#

• Jul 25, 2023 — CISA adds the original bug, CVE-2023-35078, to KEV.
• Jul 26, 2023 — Rapid7 reports the bypass to Ivanti.
• Aug 2, 2023 — Ivanti and Rapid7 disclose CVE-2023-35082, initially for Core 11.2 and older.
• Aug 7, 2023 — Ivanti widens the scope to EPMM 11.8 to 11.10 and Core 11.7 and below, and releases an RPM script.
• Aug 21, 2023 — EPMM 11.11.0.0 includes the fix.
• Jan 18, 2024 — CISA adds CVE-2023-35082 to KEV, with a February 8 federal deadline.

Vulnerability records

• CVE-2023-35082 · KEV 2024-01-18 · An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Ivanti — CVE-2023-35082: Remote Unauthenticated API Access Vulnerability in MobileIron Core 11.2 and older hub.ivanti.com
2. Rapid7 — CVE-2023-35082: MobileIron Core Unauthenticated API Access Vulnerability rapid7.com
3. CVE record — CVE-2023-35082 cve.org
4. NVD — CVE-2023-35082 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2023-35082 cisa.gov

Coverage and analysis

1. Help Net Security — Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms helpnetsecurity.com