Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability impacts OCO-Server, an application used for managing computers and mobile devices. It allows an unauthenticated attacker to impersonate a registered device by forging an enrollment request, potentially leading to control over the device's mobile device management (MDM) relationship. The main concern is confirming relevance and exposure, as the affected endpoint is designed to be externally accessible for remote device management.
- Attackers can forge device identities to gain management control.
- It affects how company devices are remotely managed.
- Confirm relevance and assess potential exposure to affected devices.
Attack Path
How an attacker could exploit the issue
An attacker can impersonate a managed device by forging an MDM enrollment request. The server trusts a self-signed certificate embedded in the request, allowing an attacker to obtain a valid MDM identity for a device they know. This grants the attacker control over the device's mobile device management relationship, enabling them to read management data, replace the push token, and disrupt or redirect enrollment.
- Unauthenticated network access required.
- Forged enrollment request triggers vulnerability.
- Device hijack and MDM control risk.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker could impersonate a registered device to gain control over its mobile device management (MDM) relationship. This could allow them to read management data, alter its push token, or disrupt its enrollment.
- Device MDM certificates and keys.
- Forged enrollment request signed with attacker certificate.
- Attackers control device MDM relationship.
Operational Fix
Recommended remediation, mitigation, and detection steps
The self-hosted OCO-Server application, specifically its Apple MDM enrollment endpoint, is vulnerable to remote code execution. Application owners and infrastructure teams are likely responsible for managing this self-hosted system. The immediate priority is to identify all instances of OCO-Server, determine their internet reachability and business criticality, and confirm the accountable owner for remediation planning.
- Identify OCO-Server instances and assess exposure.
- Verify MDM enrollment endpoint reachability and criticality.
- Plan and execute version upgrade or vendor engagement.
