How to remediate – MobileIron API Settings

1. Introduction

The MobileIron API Settings vulnerability concerns the configuration of credentials used for checks performed via the MobileIron Web API. Incorrectly configured API settings can allow unauthorized access to the MobileIron system. This affects businesses by potentially exposing sensitive data and allowing attackers to compromise device management infrastructure. Systems usually affected are those running the MobileIron platform, specifically its web application components. A successful exploit could lead to confidentiality, integrity, and availability loss of managed mobile devices and associated corporate information.

2. Technical Explanation

This vulnerability arises from insecurely configured API credentials within the MobileIron Web API. An attacker gaining access to these credentials can bypass normal authentication controls and execute commands against the system. The primary precondition for exploitation is knowledge of, or ability to discover, the API credentials.

• Root cause: Weak or default API credentials are used for accessing the MobileIron Web API.
• Exploit mechanism: An attacker uses the compromised credentials in API requests to perform unauthorized actions, such as device enrollment, data retrieval, or policy modification. For example, an attacker could use a tool like curl to send authenticated requests with stolen credentials.
• Scope: Affected platforms are MobileIron Core installations using the Web API. Specific versions depend on configuration and patching status.

3. Detection and Assessment

Confirming vulnerability involves checking the configured API settings within the scan policy. A quick check can verify if default credentials are still in use. Thorough assessment requires reviewing all API credential configurations for strong passwords and appropriate access controls.

• Quick checks: Check your scan policies to see if any default usernames or passwords are used for MobileIron Web API connections.
• Scanning: Nessus plugin ID 139648 can identify this issue, but results should be verified manually.
• Logs and evidence: Review MobileIron system logs for authentication attempts using suspicious credentials. Look for failed login attempts followed by successful logins with the same credentials.

curl -k -u : https:///core/api/v1/devices

4. Solution / Remediation Steps

Fixing this issue requires updating API credentials to strong, unique passwords and ensuring appropriate access controls are in place. The steps below outline how to do this within the scan policy configuration.

4.1 Preparation

• Ensure you have a record of the previous credentials for roll back purposes. A simple text file is sufficient. Change windows are not typically required, but approval may be needed depending on internal policy.

4.2 Implementation

1. Step 1: Open your scan policy in the scanning tool’s interface.
2. Step 2: Navigate to the ‘Credentials’ section for MobileIron Web API checks.
3. Step 3: Replace any default or weak credentials with strong, unique passwords.
4. Step 4: Save the updated scan policy.

4.3 Config or Code Example

Before

Username: admin
Password: password123

After

Username: strong_api_user
Password: VeryComplexP@sswOrd!

4.4 Security Practices Relevant to This Vulnerability

Several security practices directly address this vulnerability type. Least privilege reduces the impact if credentials are compromised. Strong password policies ensure that API keys are difficult to guess or crack. Regular credential rotation limits the window of opportunity for attackers.

• Practice 1: Implement least privilege by granting only necessary permissions to API users.
• Practice 2: Enforce strong password policies with minimum length, complexity, and regular changes.

4.5 Automation (Optional)

If you use infrastructure-as-code for your scanning tool configuration, update the credentials section in your code repository. Be careful to protect the sensitive credential data using a secrets management solution.

# Example Ansible snippet - replace with your actual configuration method
- name: Update MobileIron API Credentials
  ansible.builtin.copy:
    src: /path/to/secure_credentials.yml
    dest: /path/to/scan_policy.yml
  no_log: true # Protect sensitive credentials in logs

5. Verification / Validation

Confirm the fix by verifying that the new credentials are used for API authentication and that the old credentials no longer work. A service smoke test should confirm normal device management operations continue to function.

• Post-fix check: Run a scan using the updated credentials and verify successful connection to the MobileIron Web API.
• Re-test: Re-run the Nessus plugin ID 139648, it should no longer report the vulnerability.
• Smoke test: Confirm that device enrollment, policy updates, and data synchronization continue to function as expected.
• Monitoring: Monitor MobileIron system logs for authentication failures using the old credentials.

curl -k -u strong_api_user: https:///core/api/v1/devices

6. Preventive Measures and Monitoring

Update security baselines to include strong API credential requirements. Implement checks in CI or deployment pipelines to prevent weak credentials from being committed. A regular patch review cycle ensures timely updates for known vulnerabilities.

• Baselines: Update your security baseline to require strong passwords and multi-factor authentication for all MobileIron API access.
• Asset and patch process: Review MobileIron system configurations on a quarterly basis to ensure compliance with security policies.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Interruption of service for any integrations using the MobileIron API. Mitigation is to coordinate with integration owners and test thoroughly.
• Risk or side effect 2: Incorrectly configured credentials may prevent access to the MobileIron system. Mitigation is to have a documented roll back plan.
• Roll back:
  1. Open your scan policy in the scanning tool’s interface.
  2. Navigate to the ‘Credentials’ section for MobileIron Web API checks.
  3. Restore the previous credentials from your backup.
  4. Save the updated scan policy.

8. References and Resources

• Vendor advisory or bulletin: MobileIron API Settings Vulnerability
• NVD or CVE entry: N/A
• Product or platform documentation relevant to the fix: MobileIron API Authentication Documentation