CVE-2020-35138

Vulnerability

The MobileIron Mobile@Work agents through March 22, 2021 for Android and iOS contain a hardcoded encryption key used to encrypt username/password details during authentication [1][2]. The key is located in the file com/mobileiron/common/utils/C4928m.java [1][2]. This static key is embedded in the agent binary and can be extracted by an attacker who analyzes the application [1][2]. The vulnerability affects all versions of the Mobile@Work agent up to that date [1][2].

Exploitation

An unauthenticated attacker with access to a copy of the Mobile@Work agent can extract the hardcoded encryption key [1][2]. With this key, the attacker can construct valid MobileIron authentication requests and decrypt captured ciphertexts [1][2][3]. The attacker does not require any special network position or authentication to obtain the key, as it is static in the application [1][2]. The freely available tool rustyIron implements methods to decrypt MobileIron ciphertext and perform user enumeration using this key [3].

Impact

An attacker who successfully extracts the hardcoded key can decrypt authentication ciphertexts and construct authentication requests, enabling account enumeration and single-factor authentication attacks [1][2][3]. This could lead to the compromise of user credentials and unauthorized access to corporate resources managed by MobileIron [1][2]. While the vendor asserts no direct causality between credential encryption and man-in-the-middle (MitM) attacks [4], the hardcoded key reduces the security of the authentication process.

Mitigation

Ivanti (the vendor, formerly MobileIron) states that the hardcoded encryption key finding presents a medium risk and can be mitigated by proper configuration [4]. As of the publication date (2021-03-29), no patch or updated version removing the static key is mentioned in the references. Organizations can reduce the attack surface by disabling MobileIron discovery services [1][2]. Administrators should follow Ivanti's security hardening guides and monitor for updates from the vendor [4]. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.