CVE-2021-30497
📋 TL;DR
CVE-2021-30497 is an absolute path traversal vulnerability in Ivanti Avalanche (Premise) that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability exists in the /AvalancheWeb/image endpoint where the imageFilePath parameter is not properly validated. Organizations running vulnerable versions of Ivanti Avalanche are affected.
💻 Affected Systems
- Ivanti Avalanche (Premise)
📦 What is this software?
Avalanche by Ivanti
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files (like SAM databases, configuration files, credentials), potentially leading to full system compromise and lateral movement within the network.
Likely Case
Attackers exfiltrate sensitive configuration files, system files, or application data, leading to information disclosure and potential credential theft.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Avalanche server itself rather than the entire network.
🎯 Exploit Status
The exploit requires simple HTTP requests with path traversal sequences. Public exploit code and technical details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.3 or later
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US
Restart Required: Yes
Instructions:
1. Download the latest version from Ivanti support portal. 2. Backup current configuration. 3. Install the update following Ivanti's upgrade documentation. 4. Restart the Avalanche services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to the Avalanche web interface to trusted IP addresses only
Use firewall rules to limit access to port 8080/TCP (default Avalanche web port) to authorized management networks
Web Application Firewall
allDeploy a WAF with path traversal protection rules
Configure WAF to block requests containing '../' sequences or absolute paths in the imageFilePath parameter
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Avalanche server from critical systems
- Deploy intrusion detection rules to monitor for path traversal attempts to the /AvalancheWeb/image endpoint
🔍 How to Verify
Check if Vulnerable:
Test by sending a GET request to /AvalancheWeb/image?imageFilePath=C:/Windows/system32/config/system.sav and checking if the file content is returnedCheck Version:
Check the Avalanche web interface login page or administration console for version informationVerify Fix Applied:
After patching, the same test request should return an error or empty response instead of file content📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /AvalancheWeb/image with path traversal sequences (../, absolute paths)
- Unusual file access patterns from the Avalanche web service
Network Indicators:
- HTTP GET requests to /AvalancheWeb/image containing Windows path patterns or ../ sequences
SIEM Query:
source="avalanche_logs" AND uri_path="/AvalancheWeb/image" AND (uri_query CONTAINS "../" OR uri_query CONTAINS "C:/")🔗 References
- https://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US
- https://help.ivanti.com/wl/help/en_us/aod/5.4/Avalanche/Console/Launching_the_Avalanche.htm
- https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/
- https://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US
- https://help.ivanti.com/wl/help/en_us/aod/5.4/Avalanche/Console/Launching_the_Avalanche.htm
- https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/
