CVE-2022-36978
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Ivanti Avalanche systems by bypassing authentication and exploiting insecure deserialization in the Notification Server service. Attackers can gain code execution with service account privileges. Affects Ivanti Avalanche installations version 6.3.2.3490.
💻 Affected Systems
- Ivanti Avalanche
📦 What is this software?
Avalanche by Ivanti
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining service account privileges, lateral movement within network, data exfiltration, and persistence establishment.
Likely Case
Remote code execution leading to service disruption, data theft, and potential ransomware deployment.
If Mitigated
Limited impact due to network segmentation, proper authentication controls, and monitoring preventing successful exploitation.
🎯 Exploit Status
Authentication bypass exists, making exploitation easier. ZDI-CAN-15448 reference suggests detailed technical analysis available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.4 and later
Vendor Advisory: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
Restart Required: Yes
Instructions:
1. Download Ivanti Avalanche 6.3.4 or later from official sources. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the Notification Server service and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
windowsRestrict network access to Notification Server service (default port 1777/TCP) to trusted hosts only.
Windows Firewall: New-NetFirewallRule -DisplayName "Block Avalanche Notification" -Direction Inbound -LocalPort 1777 -Protocol TCP -Action Block
Service Account Hardening
windowsReduce privileges of the service account running Notification Server to minimum required.
sc.exe config "Avalanche Notification Server" obj= "NT AUTHORITY\LocalService"
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure of Notification Server service
- Enable detailed logging and monitoring for deserialization attempts and authentication bypass patterns
🔍 How to Verify
Check if Vulnerable:
Check Avalanche version in Control Panel > Programs > Programs and Features. If version is 6.3.2.3490 or earlier, system is vulnerable.Check Version:
wmic product where name="Ivanti Avalanche" get versionVerify Fix Applied:
Verify version is 6.3.4 or later. Test Notification Server functionality remains operational after patch.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to Notification Server
- Deserialization errors in application logs
- Process creation by Notification Server service account
Network Indicators:
- Unexpected connections to port 1777/TCP
- Malformed serialized data packets to Notification Server
SIEM Query:
source="avalanche_logs" AND (event_id="500" OR message="*deserialization*" OR message="*authentication bypass*")