CVE-2024-24998
📋 TL;DR
This path traversal vulnerability in Ivanti Avalanche allows authenticated remote attackers to execute arbitrary commands with SYSTEM privileges. It affects Ivanti Avalanche versions before 6.4.3. Attackers can leverage this to gain complete control over affected systems.
💻 Affected Systems
- Ivanti Avalanche
📦 What is this software?
Avalanche by Ivanti
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling data theft, ransomware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized command execution leading to data exfiltration, credential harvesting, and installation of malware or persistence mechanisms.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and monitoring preventing successful exploitation.
🎯 Exploit Status
Requires authenticated access but path traversal to RCE is typically straightforward once discovered. Weaponization likely given high impact and CVSS score.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.3
Vendor Advisory: https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
Restart Required: Yes
Instructions:
1. Download Ivanti Avalanche 6.4.3 from official sources. 2. Backup current configuration and data. 3. Install the update following Ivanti's upgrade documentation. 4. Restart the Avalanche server and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Avalanche web interface to trusted networks only
Authentication Hardening
allImplement strong authentication controls and monitor for suspicious login attempts
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Avalanche web interface
- Enable detailed logging and monitoring for path traversal attempts and unusual command execution
🔍 How to Verify
Check if Vulnerable:
Check Avalanche version via web interface admin panel or installed program versionCheck Version:
Check via Avalanche web interface: Admin > About, or on Windows: Check installed programs list for Ivanti Avalanche versionVerify Fix Applied:
Verify version is 6.4.3 or later in admin panel and test path traversal attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file path access patterns in web logs
- Unexpected command execution events
- Authentication from unusual sources
Network Indicators:
- HTTP requests with directory traversal sequences (../, ..\) to Avalanche endpoints
- Outbound connections from Avalanche server to unexpected destinations
SIEM Query:
source="avalanche_logs" AND (uri="*../*" OR uri="*..\\*" OR event="command_execution")