CVE-2021-42132

What it actually does

The vulnerability is a command injection flaw in Ivanti Avalanche versions before 6.3.3 that allows a low-privileged attacker with access to the Inforail Service to cause the server to execute arbitrary operating-system commands. Because exploitation requires no user interaction and can be performed over the network by an authenticated or service-access-capable attacker, successful exploitation can result in full compromise of confidentiality, integrity, and availability on the affected Avalanche server. The supplied package metadata also references cocoapods/cocoapods-downloader with a fix at commit 591167a841c64ca1ae9a8b411c1d1bdffc3bf285; organizations should verify whether this applies to their software inventory and patch accordingly.

Why it matters to the business

A compromised Avalanche server can give an attacker control over infrastructure used to manage mobile, warehouse, or endpoint devices, potentially disrupting operations, altering device configurations, stealing credentials or management data, and using the server as a foothold for broader network movement. The CVSS score is high and the EPSS score is elevated, indicating meaningful likelihood of exploitation despite the vulnerability not currently appearing in the CISA Known Exploited Vulnerabilities catalog or being explicitly associated with ransomware campaigns. Because the issue has been public since 2021, unpatched systems should be treated as long-lived exposure with increased risk of opportunistic targeting.

How an attack unfolds

An attacker first obtains or already has access to the Inforail Service interface, such as through valid low-privileged credentials, exposed service access, or compromise of an account or system that can reach the service. The attacker then submits crafted input to a vulnerable command-handling path that fails to properly separate data from operating-system command syntax. The service passes the attacker-controlled value to the underlying shell or command execution routine, causing the server to run attacker-chosen commands with the privileges of the Avalanche service process. After code execution, the attacker may enumerate the host, dump credentials or tokens, stage payloads, create persistence, modify managed-device configuration, exfiltrate sensitive data, or pivot to adjacent systems.

How to fix it

Upgrade Ivanti Avalanche to version 6.3.3 or later, which addresses the command injection issue. Restrict network access to the Inforail Service to only required administrative or application systems using host firewalls, network ACLs, VPN segmentation, and allowlists. Remove unnecessary external exposure and require strong authentication for service access. Run Avalanche services under least-privileged service accounts where supported, rotate credentials that may be accessible from the Avalanche host, and review administrative accounts for unnecessary privileges. If cocoapods/cocoapods-downloader is present in software supply-chain tooling, ensure the installed source includes commit 591167a841c64ca1ae9a8b411c1d1bdffc3bf285 or a later fixed revision, and rebuild affected dependencies where applicable.

How to confirm the fix worked

Confirm the installed Ivanti Avalanche version is 6.3.3 or later using the product console, installed software inventory, vendor package metadata, or executable file versions. Verify that the Inforail Service is not reachable from untrusted networks and is limited to expected management paths. Perform an authenticated configuration review to ensure least-privilege service accounts and strong access controls are in place. Use vulnerability scanners or configuration management tools to identify Avalanche installations older than 6.3.3. If validating the provided package metadata, inspect dependency lockfiles, source revision data, or package manager output to confirm cocoapods/cocoapods-downloader is at or beyond commit 591167a841c64ca1ae9a8b411c1d1bdffc3bf285. After patching, re-run exposure scans and confirm that attempts to inject shell metacharacters into service parameters are rejected, sanitized, or logged without command execution.

Typical attack path

1. Identify an exposed or reachable Ivanti Avalanche Inforail Service instance running a vulnerable version before 6.3.3.
2. Obtain low-privileged access or otherwise gain the ability to interact with the Inforail Service.
3. Send crafted input containing command-control characters or shell metacharacters to the vulnerable service function.
4. Achieve arbitrary command execution under the service account context.
5. Run discovery commands to identify users, network configuration, stored credentials, database connections, and managed-device data.
6. Deploy tooling or scripts for persistence, credential access, lateral movement, or data theft.
7. Use the compromised management server to disrupt operations, alter configurations, or expand access within the environment.

How to detect it

To determine whether exploitation already occurred, review Avalanche application logs, Inforail Service logs, Windows Event Logs, endpoint detection telemetry, process creation logs, firewall logs, proxy logs, and authentication records covering the period before remediation. Focus on commands spawned by Avalanche or Inforail-related service processes, especially child processes such as cmd.exe, powershell.exe, wmic.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, net.exe, net1.exe, whoami.exe, ipconfig.exe, nltest.exe, rundll32.exe, regsvr32.exe, mshta.exe, or script interpreters. Look for shell metacharacters in service request logs, including semicolons, ampersands, pipes, backticks, command substitution, redirection operators, and encoded payloads. In Windows telemetry, review Event ID 4688 process creation, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connections, Event ID 7045 service installation, Event ID 4697 service installation, Event ID 4720 local user creation, Event ID 4732 group membership changes, and scheduled task creation events. Investigate unexpected outbound connections from Avalanche servers, especially to file-sharing sites, paste sites, dynamic DNS domains, VPS infrastructure, or unusual ports. Also inspect the host for new or modified services, scheduled tasks, startup items, dropped executables or scripts in temporary directories, unexpected administrative accounts, credential-dumping artifacts, and anomalous configuration changes to managed devices.

• Inforail
• Avalanche
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache -split -f
• bitsadmin /transfer
• curl.exe http
• wget http
• whoami.exe
• ipconfig.exe /all
• net user
• net localgroup administrators
• nltest /domain_trusts
• wmic.exe process call create
• rundll32.exe
• regsvr32.exe /s /n /u /i:
• mshta.exe
• schtasks /create
• sc.exe create
• Event ID 4688
• Event ID 7045
• Event ID 4697
• Event ID 4720
• Event ID 4732
• Sysmon Event ID 1
• Sysmon Event ID 3
• C:\\Program Files\\Wavelink\\Avalanche
• C:\\Program Files (x86)\\Wavelink\\Avalanche
• C:\\Windows\\Temp\\
• C:\\Users\\Public\\
• /bin/sh -c
• bash -c
• ; whoami
• && whoami
• | whoami

What your security team should do

• Prioritize patching all Ivanti Avalanche deployments before 6.3.3, especially systems reachable from user networks, partner networks, VPNs, or the internet.
• Immediately restrict access to the Inforail Service to explicitly approved hosts and administrative networks.
• Inventory Avalanche servers and related management infrastructure, then validate installed versions and patch status.
• Review recent authentication, service, application, and endpoint telemetry for suspicious commands launched by Avalanche or Inforail-related service processes.
• Rotate credentials stored on or used by affected Avalanche servers if exploitation is suspected or patch status has been unknown for an extended period.
• Hunt for post-exploitation behavior such as web downloads, encoded PowerShell, new local users, scheduled tasks, service creation, unexpected remote access tools, or outbound connections from the management server.
• If cocoapods/cocoapods-downloader is present in build or dependency tooling, validate that the fixed commit 591167a841c64ca1ae9a8b411c1d1bdffc3bf285 or later is in use.
• Place Avalanche servers under heightened monitoring because the vulnerability is old, high impact, and has an elevated EPSS probability even though it is not currently listed in CISA KEV.