MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution

id: CVE-2020-15505

# THIS TEMPLATE IS ONLY FOR DETECTING
# To carry out further attacks, please see reference[2] below.
# This template works by passing a Hessian header, otherwise;
# it will return a 403 or 500 internal server error. Reference[3].
info:
  name: MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier contain a vulnerability that allows remote attackers to execute arbitrary code via unspecified vectors.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to complete compromise of the MobileIron infrastructure.
  remediation: |
    Upgrade MobileIron Core & Connector and Sentry to versions above v10.6 & v9.8 respectively
  reference:
    - https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
    - https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
    - https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
    - https://github.com/orangetw/JNDI-Injection-Bypass
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15505
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-15505
    cwe-id: CWE-706
    epss-score: 0.99737
    epss-percentile: 0.99953
    cpe: cpe:2.3:a:mobileiron:core:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mobileiron
    product: core
  tags: cve,cve2020,mobileiron,rce,sentry,kev,vkev,vuln

http:
  - raw:
      - |
        POST /mifs/.;/services/LogService HTTP/1.1
        Host: {{Hostname}}
        Referer: https://{{Hostname}}
        Content-Type: x-application/hessian
        Connection: close

        {{hex_decode('630200480004')}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/x-hessian"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f99a98d74f3080964d4ff99cdb8424e788493fd808049ddf9fa1bf729efccd4f02201ddd15fcfcd936957df6ce749a9f6557b5832a32e16402906e5ea0ec41037715:922c64590222798bb761d5b6d8e72950