CVE-2024-24994
📋 TL;DR
This path traversal vulnerability in Ivanti Avalanche allows authenticated remote attackers to execute arbitrary commands with SYSTEM privileges. It affects Ivanti Avalanche versions before 6.4.3. Attackers can achieve full system compromise through the web component.
💻 Affected Systems
- Ivanti Avalanche
📦 What is this software?
Avalanche by Ivanti
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with SYSTEM privileges, enabling installation of persistent malware, data exfiltration, and lateral movement across the network.
Likely Case
Attackers gain SYSTEM-level command execution, allowing them to install backdoors, steal credentials, and pivot to other systems.
If Mitigated
With proper network segmentation and least privilege, impact is limited to the Avalanche server itself, though SYSTEM access remains dangerous.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The CVSS score of 8.8 indicates high exploitability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.3
Vendor Advisory: https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
Restart Required: Yes
Instructions:
1. Download Ivanti Avalanche 6.4.3 from the Ivanti support portal. 2. Backup current configuration and data. 3. Run the installer to upgrade to version 6.4.3. 4. Restart the Avalanche service or server as required.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to the Avalanche web interface to trusted IP addresses only.
Strong Authentication Controls
allImplement multi-factor authentication and strong password policies for Avalanche accounts.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Avalanche web interface.
- Monitor for suspicious authentication attempts and command execution patterns on the Avalanche server.
🔍 How to Verify
Check if Vulnerable:
Check the Avalanche version in the web interface under Help > About. If version is below 6.4.3, the system is vulnerable.Check Version:
Not applicable - check via web interface or Windows Programs and FeaturesVerify Fix Applied:
After patching, verify the version shows 6.4.3 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns to Avalanche web interface
- Suspicious command execution events in Windows Event Logs from Avalanche processes
Network Indicators:
- Unusual outbound connections from the Avalanche server
- Traffic patterns suggesting command and control activity
SIEM Query:
source="windows" AND (process_name="avalanche*" OR process_name="w3wp*") AND (event_id=4688 OR command_line CONTAINS "cmd.exe" OR command_line CONTAINS "powershell")