Finding a three 0-day exploit chain in Ivanti EPMM and Ivanti Sentry - Tor E. Bjørstad

This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity #ndcconferences #security #developer #softwaredeveloper Attend the next NDC conference near you: https://ndcconferences.com https://ndc-security.com/ Subscribe to our YouTube channel and learn every day: /@NDC Follow our Social Media! https://www.facebook.com/ndcconferences https://twitter.com/NDC_Conferences https://www.instagram.com/ndc_conferences/ During the summer of 2023, a team at mnemonic discovered three 0-day vulnerabilities in Ivanti Endpoint Protection Manager Mobile (EPMM, formerly known as Mobileiron Core) and Ivanti Sentry. - CVE-2023-35078: authentication bypass in Ivanti EPMM, CVSS 9.8 - CVE-2023-35081: path traversal / arbitrary file write in Ivanti EPMM, CVSS 7.2 - CVE-2023-38035: authentication bypass in Ivanti Sentry, CVSS 9.8, allowing command execution as root. All three vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog, as they are known to have been exploited by threat actors in the wild. Ivanti has also confirmed that the vulnerabilities can be combined in an exploit chain. In this talk we'll take a closer look at what actually happened.