CVE-2021-30497

What it actually does

CVE-2021-30497 is an unauthenticated absolute path traversal vulnerability in Ivanti Avalanche on-premises 6.3.2. The /AvalancheWeb/image endpoint accepts an imageFilePath parameter and fails to ensure that the requested path remains inside the intended image directory. A remote attacker can supply an absolute filesystem path, such as a Windows system file path, and cause the application to return arbitrary readable files. The primary impact is confidentiality loss: attackers may retrieve configuration files, application secrets, credentials, keys, database connection details, or operating system files accessible to the Avalanche web service account. The CVSS vector indicates network exploitable, low complexity, no authentication, no user interaction, and high confidentiality impact, with no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose sensitive operational data from Ivanti Avalanche servers, including credentials or configuration details that may enable broader compromise of device-management infrastructure. Because Avalanche is used to manage enterprise mobile and warehouse devices, disclosure of management-server secrets can create downstream risk to managed endpoints, logistics operations, inventory systems, and administrative trust boundaries. The EPSS score is very high at 0.9658 and exploit maturity is listed as weaponized, so internet-exposed or broadly reachable Avalanche deployments should be treated as high-priority even though the vulnerability is not currently listed in CISA KEV and is not specifically marked as ransomware-associated.

How an attack unfolds

An attacker first identifies an Ivanti Avalanche web interface and confirms that the /AvalancheWeb/image endpoint is reachable without authentication. They then craft an HTTP request that sets the imageFilePath parameter to an absolute path rather than a legitimate image path. Because the application does not properly constrain the value to the expected image directory, it attempts to read the attacker-supplied file from the server filesystem and returns its contents in the HTTP response. The attacker repeats this process to enumerate high-value files, such as application configuration files, backup files, service account materials, Windows registry hive backups, logs, or credential stores readable by the web process. Any recovered secrets can then be used for follow-on access, lateral movement, or targeting of Avalanche-managed infrastructure.

How to fix it

Upgrade Ivanti Avalanche to a vendor-supported version that contains the path traversal fix. If no exact fixed version is available in internal tracking, consult Ivanti advisories and release notes for the corrected Avalanche release line and avoid remaining on Avalanche 6.3.2. As interim mitigation, restrict access to the Avalanche web interface to trusted administrative networks or VPN users only, block unauthenticated access to /AvalancheWeb/image where feasible, and use a web application firewall or reverse proxy rule to deny imageFilePath values containing absolute paths, drive letters, path traversal sequences, URL-encoded traversal, or references to sensitive OS/application directories. Review filesystem permissions so the Avalanche web service account cannot read unnecessary system, backup, credential, or configuration files. Rotate any credentials or secrets that may have been stored on or accessible from the affected server if exploitation is suspected.

How to confirm the fix worked

Confirm the deployed Ivanti Avalanche version is no longer 6.3.2 and matches a vendor-supported fixed release. Validate exposure by reviewing network access controls to ensure the Avalanche web interface is not broadly reachable. Perform a safe, authorized negative test against /AvalancheWeb/image using a benign absolute path and verify the application rejects the request rather than returning file contents. Check that WAF or reverse proxy controls block imageFilePath requests containing drive-letter paths, encoded traversal sequences, and sensitive directory references. Confirm the Avalanche service account has least-privilege filesystem access and cannot read unrelated system files or sensitive configuration backups.

Typical attack path

1. Discover an Ivanti Avalanche on-premises web interface exposed to the network or internet.
2. Send unauthenticated requests to /AvalancheWeb/image to verify the endpoint is reachable.
3. Provide an absolute filesystem path in the imageFilePath parameter instead of a valid image path.
4. Retrieve sensitive files returned by the vulnerable application.
5. Search retrieved files for credentials, database connection strings, API keys, session secrets, certificates, or administrative configuration.
6. Use exposed secrets to expand access to the Avalanche server, backend services, or related management infrastructure.

How to detect it

Review Avalanche web server, reverse proxy, WAF, load balancer, and application access logs for unauthenticated requests to /AvalancheWeb/image containing the imageFilePath parameter with absolute Windows paths, drive letters, path traversal sequences, URL-encoded traversal, or references to sensitive directories. Focus on HTTP 200 responses or unusually large responses because successful exploitation returns file contents. Investigate repeated requests from the same source IP that enumerate different paths, especially requests for Windows registry hives, application configuration files, backup files, logs, credential stores, or database configuration. Search for encoded variants such as %2e%2e, %2f, %5c, %3a, and mixed slash/backslash paths. Correlate suspicious web requests with outbound connections, new administrative logins, service restarts, unusual process execution, or credential use from the Avalanche server after the file-read activity. If logs show access to sensitive files, assume exposed secrets may be compromised and rotate them.

• /AvalancheWeb/image
• imageFilePath=
• imageFilePath=C:/
• imageFilePath=C:\
• imageFilePath=C%3A%2F
• imageFilePath=C%3A%5C
• C:/Windows/system32/config/system.sav
• C:\Windows\system32\config\system.sav
• C%3A%2FWindows%2Fsystem32%2Fconfig%2Fsystem.sav
• C%3A%5CWindows%5Csystem32%5Cconfig%5Csystem.sav
• /AvalancheWeb/image?imageFilePath=C:/Windows/system32/config/system.sav
• /AvalancheWeb/image?imageFilePath=C%3A%2FWindows%2Fsystem32%2Fconfig%2Fsystem.sav
• imageFilePath=..%2f
• imageFilePath=..%5c
• imageFilePath=%2e%2e%2f
• imageFilePath=%2e%2e%5c
• imageFilePath=../../
• imageFilePath=..\..\
• /Windows/System32/config/
• \Windows\System32\config\
• win.ini
• boot.ini

What your security team should do

• Prioritize remediation for any internet-facing or untrusted-network-accessible Ivanti Avalanche deployment because EPSS is very high and exploitation is weaponized.
• Inventory all Ivanti Avalanche on-premises instances and identify systems running version 6.3.2 or other unpatched releases.
• Upgrade to a vendor-supported fixed version and document the final remediated version for each instance.
• Immediately restrict Avalanche web access to trusted administrative networks or VPN paths until patching is complete.
• Add WAF, reverse proxy, or web server filtering for suspicious /AvalancheWeb/image requests using imageFilePath values with absolute paths, traversal sequences, encoded traversal, or sensitive system paths.
• Review historical web access logs for suspicious imageFilePath requests and file-read attempts.
• If suspicious access is found, preserve logs, collect forensic artifacts, and rotate credentials or secrets that may have been readable from the Avalanche server.
• Harden filesystem permissions for the Avalanche service account and remove unnecessary local backups or plaintext secrets from the server.