Skip to content
Nuclei Templates

MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution

ID: CVE-2020-15505

Severity: critical

Author: dwisiswant0

Tags: cve,cve2020,mobileiron,rce,sentry,kev

Description

Section titled “Description”

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier contain a vulnerability that allows remote attackers to execute arbitrary code via unspecified vectors.

YAML Source

Section titled “YAML Source”
id: CVE-2020-15505


# THIS TEMPLATE IS ONLY FOR DETECTING
# To carry out further attacks, please see reference[2] below.
# This template works by passing a Hessian header, otherwise;
# it will return a 403 or 500 internal server error. Reference[3].
info:
  name: MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier contain a vulnerability that allows remote attackers to execute arbitrary code via unspecified vectors.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the MobileIron infrastructure.
  remediation: |
    Upgrade MobileIron Core & Connector and Sentry to versions above v10.6 & v9.8 respectively
  reference:
    - https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
    - https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
    - https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
    - https://github.com/orangetw/JNDI-Injection-Bypass
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15505
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-15505
    cwe-id: CWE-706
    epss-score: 0.97516
    epss-percentile: 0.99983
    cpe: cpe:2.3:a:mobileiron:core:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mobileiron
    product: core
  tags: cve,cve2020,mobileiron,rce,sentry,kev


http:
  - raw:
      - |
        POST /mifs/.;/services/LogService HTTP/1.1
        Host: {{Hostname}}
        Referer: https://{{Hostname}}
        Content-Type: x-application/hessian
        Connection: close


        {{hex_decode('630200480004')}}


    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/x-hessian"


      - type: status
        status:
          - 200
# digest: 4a0a004730450221008ce4b42e668e66eca5d47a6286bc887cf62d516b5fe9de1fc2d7952b6a47911802202f3e67b0e82e6f96c5c187f16cf92df9d661eaff31d5561839ee65724a00ad41:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-15505.yaml"

View on Github