CVE-2023-35084
Published: 18 October 2023
Summary
CVE-2023-35084 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Ivanti Endpoint Manager 2022 SU3 and all prior versions contain a deserialization flaw (CWE-502) that arises when user-supplied input is processed without adequate validation. The vulnerability carries a CVSS 3.1 score of 9.8 and permits remote, unauthenticated execution of arbitrary operations on the affected management server.
An attacker with network access can submit a crafted serialized object that the application deserializes, resulting in immediate command execution with the privileges of the Endpoint Manager service. No user interaction or credentials are required, enabling an unauthenticated remote attacker to achieve full compromise of the management console and any managed endpoints.
Ivanti published security advisory SA-2023-08-08-CVE-2023-35084 detailing the issue and directing customers to apply the vendor-supplied remediation. The associated EPSS score has remained flat at 0.0527 since disclosure, indicating no material increase in observed exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-39119
Vulnerability details
Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.