CVE-2022-36974

What it actually does

CVE-2022-36974 is a remote code execution vulnerability in Ivanti Avalanche 6.3.2.3490 affecting the Web File Server service. The flaw is caused by insufficient validation of attacker-controlled input that is later deserialized by the application. Although the vulnerable workflow is described as requiring authentication, the authentication mechanism can be bypassed, making the practical exposure equivalent to unauthenticated network-based exploitation. Successful exploitation allows arbitrary code execution in the security context of the Web File Server service account, potentially enabling full compromise of the Avalanche server depending on that account's privileges.

Why it matters to the business

Compromise of Ivanti Avalanche can disrupt mobile device, wireless device, and endpoint management operations, expose managed-device data, and give attackers a foothold into networks where Avalanche is trusted for device administration. Because the CVSS score is critical and the EPSS score is high, exploitation is statistically more likely than for most vulnerabilities even though it is not currently listed in CISA KEV. Organizations using affected Avalanche versions should treat internet-facing or broadly reachable deployments as high-priority remediation targets.

How an attack unfolds

An attacker first identifies an exposed Ivanti Avalanche Web File Server service. The attacker then reaches the vulnerable service over the network and abuses the authentication bypass to access functionality that would otherwise require valid credentials. Next, the attacker sends specially crafted serialized data to the Web File Server service. Because the service does not properly validate the supplied data before deserialization, the malicious object data is processed and triggers attacker-controlled code execution. The resulting code runs as the service account, allowing the attacker to execute commands, deploy tooling, modify files, stage persistence, access sensitive Avalanche-managed data, or pivot to other systems reachable from the Avalanche server.

How to fix it

Upgrade Ivanti Avalanche to a vendor-supported release that contains the fix for this issue. If exact fixed versions are not available in asset data, consult Ivanti's advisory and release notes for CVE-2022-36974 and ensure Avalanche 6.3.2.3490 is no longer deployed. As immediate mitigations, restrict network access to Avalanche administrative and Web File Server interfaces to trusted management networks or VPN users only, block direct internet exposure, enforce host firewall rules, and run the service under the least-privileged account possible. Review any custom integrations or reverse proxies that expose Avalanche services and remove unnecessary external access.

How to confirm the fix worked

Confirm the installed Ivanti Avalanche version is not 6.3.2.3490 and matches a vendor-fixed or later supported release. Verify that the Web File Server service is not reachable from untrusted networks and that firewall or access-control rules limit access to approved administrative sources. Perform authenticated administrative checks or vulnerability scanning with a plugin that specifically detects CVE-2022-36974 rather than relying only on banner detection. Validate that the service account used by Avalanche has minimal privileges and cannot perform unnecessary administrative actions on the host or domain. After patching, restart the relevant Avalanche services and confirm normal device-management functionality.

Typical attack path

1. Scan for Ivanti Avalanche deployments and exposed Web File Server endpoints.
2. Confirm the target is running an affected Avalanche version, specifically 6.3.2.3490 or another unpatched build with the vulnerable service behavior.
3. Bypass the vulnerable authentication mechanism to reach protected Web File Server functionality.
4. Submit a crafted serialized payload to the vulnerable service.
5. Trigger unsafe deserialization and execute arbitrary code as the Web File Server service account.
6. Run reconnaissance commands, deploy a web shell or remote access tool, collect credentials or configuration data, and attempt lateral movement from the Avalanche server.

How to detect it

To determine whether exploitation already occurred, review Ivanti Avalanche application logs, Web File Server logs, Windows Event Logs, web/proxy logs, EDR telemetry, and firewall records for anomalous requests to Avalanche services followed by command execution or file creation. Focus on evidence that the Web File Server service or related Avalanche processes spawned unexpected child processes such as command shells, scripting engines, download utilities, or remote administration tools. Examine the Avalanche installation directories, web-accessible directories, temporary directories, and service working directories for recently created executables, scripts, web shells, serialized payload artifacts, or archives. Review Windows Security logs for new local users, privilege changes, suspicious service creation, scheduled tasks, or credential access after suspicious Avalanche traffic. If centralized logging is available, correlate inbound connections to Avalanche Web File Server endpoints with process execution events on the server within the same time window. No public, vulnerability-specific exploit string is reliably derivable from the provided data, so detection should emphasize behavioral indicators of unsafe deserialization leading to code execution.

• Ivanti Avalanche Web File Server service spawning cmd.exe
• Ivanti Avalanche Web File Server service spawning powershell.exe
• Ivanti Avalanche Web File Server service spawning wscript.exe
• Ivanti Avalanche Web File Server service spawning cscript.exe
• Ivanti Avalanche Web File Server service spawning rundll32.exe
• Ivanti Avalanche Web File Server service spawning regsvr32.exe
• Ivanti Avalanche Web File Server service spawning mshta.exe
• Ivanti Avalanche Web File Server service spawning certutil.exe
• Ivanti Avalanche Web File Server service spawning bitsadmin.exe
• Ivanti Avalanche Web File Server service spawning curl.exe
• Ivanti Avalanche Web File Server service spawning wget.exe
• Event ID 4688 with parent process associated with Ivanti Avalanche Web File Server
• Event ID 7045 after inbound connections to Ivanti Avalanche Web File Server
• Event ID 4698 after inbound connections to Ivanti Avalanche Web File Server
• Avalanche 6.3.2.3490

What your security team should do

• Inventory all Ivanti Avalanche servers and prioritize any internet-facing, DMZ-hosted, or broadly reachable systems.
• Upgrade affected Avalanche installations to a vendor-fixed supported version as soon as possible.
• Until patched, restrict access to Avalanche Web File Server and administrative interfaces to trusted networks only.
• Review service account privileges and reduce them to the minimum required for Avalanche operation.
• Run vulnerability scans or configuration checks to confirm CVE-2022-36974 exposure has been removed.
• Hunt for signs of prior exploitation, especially suspicious child processes spawned by Avalanche services, unexpected files in Avalanche web or service directories, and anomalous inbound requests to Web File Server endpoints.
• If exploitation is suspected, isolate the server, preserve logs and memory where possible, rotate credentials accessible from the host, and investigate lateral movement.