CVE-2024-27984
📋 TL;DR
This path traversal vulnerability in Ivanti Avalanche's web component allows authenticated remote attackers to delete specific files or cause denial of service. It affects Ivanti Avalanche versions before 6.4.3. Attackers must have valid authentication credentials to exploit this vulnerability.
💻 Affected Systems
- Ivanti Avalanche
📦 What is this software?
Avalanche by Ivanti
⚠️ Risk & Real-World Impact
Worst Case
Critical system files could be deleted, causing complete system failure, data loss, and extended service disruption.
Likely Case
Attackers delete configuration or log files, causing service disruption and operational impact until restoration.
If Mitigated
With proper access controls and monitoring, impact is limited to temporary service disruption with quick recovery.
🎯 Exploit Status
Exploitation requires authenticated access. Path traversal techniques are well-documented and relatively simple to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.3
Vendor Advisory: https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
Restart Required: Yes
Instructions:
1. Download Ivanti Avalanche 6.4.3 from official sources. 2. Backup current configuration and data. 3. Run the installer and follow upgrade prompts. 4. Restart the Avalanche service after installation completes.
🔧 Temporary Workarounds
Restrict Network Access
allLimit access to Avalanche web interface to trusted IP addresses only
Implement Web Application Firewall
allDeploy WAF with path traversal protection rules
🧯 If You Can't Patch
- Implement strict access controls and limit user permissions to minimum required
- Enable detailed logging and monitoring for file deletion attempts and path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check Avalanche version in web interface or via system information. If version is below 6.4.3, system is vulnerable.Check Version:
Check via Avalanche web interface: Admin > System Information > VersionVerify Fix Applied:
Verify version is 6.4.3 or higher in system information and test web component functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in system logs
- Path traversal patterns in web access logs (../ sequences)
- Failed authentication attempts followed by file operations
Network Indicators:
- HTTP requests containing ../ sequences to Avalanche web endpoints
- Multiple DELETE requests to unusual file paths
SIEM Query:
source="avalanche_logs" AND (event_type="file_delete" OR uri="*../*")