Week of July 31, 2023

CVE-2023-35081 is a path traversal vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows authenticated administrators to write arbitrary files. It has been actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog. Successful exploitation can lead to remote code execution and full system compromise.

Researchers discovered that a top-tier EDR product (anonymized as STRANGETRINITY) did not inject its hooking DLL into its own user-mode process, which ran without process protection. By using PPID spoofing to spawn a new instance of the EDR process and injecting shellcode via CreateRemoteThread, attackers could execute post-exploitation tools like Mimikatz without detection. The vendor confirmed this was unintended behavior and has since fixed the issue.