Top 10 winner

Unauthenticated RCE on MobileIron MDM

Orange Tsai · Orange Tsai · 11 September 2020

Chains flaws in MobileIron MDM into unauthenticated remote code execution: an Apache rewrite ACL is stepped around with a path-normalisation trick to reach a Hessian deserialization endpoint, and a new Groovy MethodClosure gadget replaces the blocked JNDI route on hosts with no outbound access. Used to get a shell on an unpatched Facebook server.

Record

Researcher

Orange Tsai

Published by

Orange Tsai

Date

11 September 2020

In the archive

• Ranked #7 in the 2020 Top 10 Web Hacking Techniques

Related sources

• HITCON 2020 slides
• Author GroovyShell gadget
• Foundational JNDI exploitation

Tags

• deserialization
• gadget-chain
• rce
• parser-differential
• auth-bypass
• java
• reverse-proxy
• cve
• attack-chain
• owasp-a01-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host.