Ivanti Sentry CVE-2023-35081: CISA Issues Urgent 3-Day Patch Mandate

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent mandate for federal agencies to address a critical security flaw in Ivanti Sentry. According to BleepingComputer, the vulnerability, identified as CVE-2023-35081, is currently under active exploitation in the wild. This path traversal CVE allows unauthenticated attackers with Privilege Escalation capabilities to bypass security controls and write files to the underlying operating system of the appliance.

Technical Analysis: The CVE-2023-35081 RCE Chain

The vulnerability resides within Ivanti Sentry, formerly known as MobileIron Sentry, which acts as a gatekeeper for enterprise mobile traffic. With a CVSS base score of 7.8, this flaw enables a remote attacker to perform directory traversal. When successfully executed, an attacker can upload malicious files, such as web shells, to sensitive directories.

While the vulnerability itself is significant, its true danger lies in the CVE-2023-35081 RCE chain. Threat actors have been observed combining this flaw with CVE-2023-35078, a Zero-Day remote unauthenticated API access vulnerability previously patched by Ivanti. By chaining these two issues, an attacker can achieve full RCE on the appliance without requiring any valid credentials. This type of exploit sequence is a classic TTP used by advanced actors to establish persistence on edge infrastructure.

Once an attacker gains a foothold on the Sentry appliance, they can facilitate Lateral Movement across the internal network. Because these appliances often sit outside the traditional firewall or in a DMZ, they are frequently bypassed by standard EDR solutions, making them prime targets for an APT or Ransomware group looking to remain undetected while exfiltrating data.

CISA KEV Inclusion and Federal Response

Due to the evidence of active exploitation, CISA has added CVE-2023-35081 to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion triggers Binding Operational Directive (BOD) 22-01, which requires Federal Civilian Executive Branch (FCEB) agencies to remediate the vulnerability within a strictly defined timeframe. In this instance, agencies have been given a three-day window to apply the necessary updates, highlighting the severity of the threat to government communications.

For organizations outside the federal government, this mandate should be viewed as a high-priority advisory. Security teams should prioritize identifying all Internet-facing Ivanti Sentry instances. Understanding how to detect CVE-2023-35081 exploit attempts involves reviewing web server logs for unusual HTTP POST requests directed at API endpoints, particularly those involving directory traversal sequences (such as ”..”) or unexpected file writes in the /tmp/ or webroot directories.

Ivanti Sentry 9.18 Path Traversal Mitigation

The primary remediation path is to upgrade Ivanti Sentry to version 9.19 or later. This version contains the necessary logic to prevent the path traversal exploit. Organizations running versions 9.18, 9.17, or 9.16 are at immediate risk and should not rely solely on network-level filtering as a permanent solution.

Actionable Recommendations for Defenders

1. Immediate Patching: Prioritize the update of Ivanti Sentry to version 9.19. If patching is not immediately possible, consider taking the appliance offline until the update can be applied.
2. Audit Logs: Search for IoC signatures related to the exploitation of path traversal flaws. Check for unauthorized administrative accounts or changes to configuration files that occurred outside of scheduled maintenance windows.
3. Monitor for Web Shells: Use the MITRE ATT&CK framework to hunt for web shells (T1505.003) that may have been dropped during the exploitation phase to maintain persistent access.
4. Review Internal Access: Ensure the Sentry appliance does not have over-privileged access to the internal network. Implementing Zero Trust principles can help limit the impact of a potential edge device compromise.

Defenders must treat this vulnerability with urgency. Edge devices are increasingly becoming the primary entry point for sophisticated cyberattacks, and the rapid exploitation of Ivanti Sentry underscores the need for proactive vulnerability management.