CVE-2022-36983
📋 TL;DR
This critical authentication bypass vulnerability in Ivanti Avalanche allows remote attackers to gain unauthorized access without credentials. The flaw exists in the SetSettings class where authentication checks are missing. All Ivanti Avalanche installations using vulnerable versions are affected.
💻 Affected Systems
- Ivanti Avalanche
📦 What is this software?
Avalanche by Ivanti
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to modify configurations, deploy malicious packages, access sensitive data, and potentially pivot to other systems.
Likely Case
Unauthorized access leading to configuration changes, data exfiltration, and potential privilege escalation within the Avalanche environment.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable systems.
🎯 Exploit Status
ZDI-CAN-15919 indicates coordinated disclosure. No public exploit code available but trivial to weaponize given the simple authentication bypass nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.4
Vendor Advisory: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
Restart Required: Yes
Instructions:
1. Download Ivanti Avalanche 6.3.4 from official vendor portal. 2. Backup current configuration and database. 3. Run installer to upgrade to version 6.3.4. 4. Restart Avalanche services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Avalanche management interface using firewall rules
# Example Windows Firewall: New-NetFirewallRule -DisplayName "Block Avalanche External" -Direction Inbound -LocalPort 1777,1778 -Protocol TCP -Action Block
# Example Linux iptables: iptables -A INPUT -p tcp --dport 1777:1778 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Avalanche servers from untrusted networks
- Deploy web application firewall (WAF) rules to block unauthorized access attempts to SetSettings endpoints
🔍 How to Verify
Check if Vulnerable:
Check Avalanche version via web interface or installation directory. Versions below 6.3.4 are vulnerable.Check Version:
On Windows: reg query "HKLM\SOFTWARE\Wavelink\Avalanche" /v VersionVerify Fix Applied:
Verify version shows 6.3.4 or higher in Avalanche web interface under Help > About.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to /avalanche/SetSettings endpoints
- Configuration changes without corresponding user authentication logs
- Unusual administrative activity from unexpected IP addresses
Network Indicators:
- HTTP requests to SetSettings endpoints without authentication headers
- Traffic to Avalanche ports (typically 1777, 1778) from unauthorized sources
SIEM Query:
source="avalanche.log" AND (uri="/SetSettings" OR uri="*SetSettings*") AND NOT (user!="" OR auth_success="true")