CVE-2022-36981

What it actually does

CVE-2022-36981 is a path traversal vulnerability in Ivanti Avalanche 6.3.3.101, specifically in the DeviceLogResource class. The vulnerable component performs file operations using user-supplied path data without sufficient validation or canonicalization. Although the affected function is nominally authenticated, the authentication mechanism can be bypassed, making the effective attack model unauthenticated over the network. A successful attacker can manipulate filesystem paths to access or write files outside the intended directory and leverage that capability to execute arbitrary code in the context of the Avalanche service account. The CVSS 9.8 rating reflects network reachability, low attack complexity, no required privileges, no user interaction, and full confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an external attacker control over the Ivanti Avalanche server, which is commonly used to manage mobile and ruggedized enterprise devices. Compromise of this platform can disrupt device management operations, expose configuration data or credentials, enable lateral movement, and allow attackers to tamper with managed-device workflows. The high EPSS score indicates a comparatively high probability of exploitation activity, so internet-exposed or broadly reachable Avalanche installations should be treated as high-priority remediation targets even though this CVE is not currently listed in CISA KEV and is not identified as ransomware-associated.

How an attack unfolds

An attacker first identifies an Ivanti Avalanche management interface that exposes the vulnerable DeviceLogResource functionality. Because the intended authentication control can be bypassed, the attacker does not need valid application credentials. The attacker then sends crafted requests containing path traversal sequences in parameters used by DeviceLogResource during file handling. By escaping the expected directory, the attacker can cause the application to read from or write to unintended filesystem locations. If the attacker can place attacker-controlled content in an executable or interpreted location, overwrite a file used by the service, or otherwise influence a code-loading path, the flaw can be escalated to arbitrary code execution. The resulting code runs with the privileges of the Avalanche service account, after which the attacker may deploy web shells or tooling, alter Avalanche configuration, harvest sensitive data, pivot to managed-device infrastructure, or use the server as a foothold for broader compromise.

How to fix it

Upgrade Ivanti Avalanche to a vendor-supported version that contains the fix for CVE-2022-36981. No fixed version was provided in the input, so administrators should consult Ivanti’s official advisory and release notes for the exact corrected Avalanche build and apply the latest available security update. If immediate upgrade is not possible, restrict network access to the Avalanche management interface to trusted administrative networks or VPNs, block external access at firewalls and reverse proxies, and monitor for traversal attempts. Run the Avalanche service under a least-privileged dedicated account, review filesystem permissions to prevent the service from writing to executable or sensitive locations, and ensure application directories are not writable by the service unless required. Where feasible, add compensating controls in WAFs or reverse proxies to block requests containing encoded or unencoded path traversal patterns targeting Avalanche endpoints.

How to confirm the fix worked

Confirm the deployed Ivanti Avalanche version is newer than the vulnerable 6.3.3.101 build and matches a vendor-supported fixed release. Validate that the management interface is not reachable from untrusted networks and that access controls require authenticated administrative access. Review reverse proxy, WAF, and application logs for blocked or allowed requests containing traversal patterns such as ../, ..\, %2e%2e%2f, %2e%2e%5c, double-encoded traversal, or suspicious references to DeviceLogResource. Perform an authenticated and unauthenticated vulnerability scan using updated scanner checks for CVE-2022-36981. If testing manually, use only non-destructive validation payloads in an authorized environment to confirm that traversal sequences are rejected and cannot access files outside intended directories.

Typical attack path

1. Discover an exposed Ivanti Avalanche server or management interface.
2. Probe Avalanche endpoints and identify reachable DeviceLogResource functionality.
3. Bypass the expected authentication requirement using the vulnerable access path.
4. Submit crafted requests containing path traversal sequences such as parent-directory references or encoded traversal characters.
5. Use the traversal primitive to access or write files outside the intended application directory.
6. Place or modify content in a location that results in server-side code execution or service-controlled execution.
7. Execute commands as the Avalanche service account.
8. Establish persistence, collect configuration or credential material, and pivot to other systems or managed-device infrastructure.

How to detect it

To determine whether exploitation already occurred, examine Avalanche application logs, web server logs, reverse proxy logs, WAF events, EDR telemetry, and operating-system security logs for suspicious requests and follow-on execution. Focus on requests to DeviceLogResource or Avalanche file/log handling endpoints containing traversal sequences, encoded traversal, absolute filesystem paths, or attempts to write into application-controlled directories. Correlate suspicious HTTP requests with process creation events from the Avalanche service account, especially command shells, scripting engines, archive utilities, file transfer tools, or unusual outbound network connections. Review file integrity and timestamps under Avalanche installation, web application, log, temporary, and configuration directories for unexpected new or modified files around the time of suspicious requests. On Windows servers, inspect service-account logons, new scheduled tasks, new services, PowerShell activity, command-line execution, and Defender/EDR alerts. Because exploitation may result in code execution rather than a single stable artifact, absence of a known filename does not rule out compromise; prioritize behavioral evidence linking traversal requests to filesystem changes or process execution.

• DeviceLogResource
• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/passwd
• C:\\Windows\\win.ini
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• certutil.exe
• bitsadmin.exe
• schtasks.exe
• Avalanche 6.3.3.101
• C:\\Program Files\\Wavelink\\Avalanche
• C:\\Program Files (x86)\\Wavelink\\Avalanche

What your security team should do

• Inventory all Ivanti Avalanche deployments and prioritize any instance running 6.3.3.101 or older vulnerable builds.
• Patch or upgrade affected Avalanche servers to the latest vendor-supported fixed release as an urgent priority due to the 9.8 CVSS score and high EPSS probability.
• Immediately remove Avalanche management interfaces from direct internet exposure and restrict access to trusted administrative networks.
• Review historical web, application, reverse proxy, WAF, EDR, and Windows event logs for exploitation attempts involving DeviceLogResource and path traversal payloads.
• Hunt for post-exploitation activity on Avalanche servers, including unexpected child processes spawned by service processes, newly created executable scripts, unfamiliar files in application directories, and outbound connections to untrusted hosts.
• Rotate credentials and secrets stored on or used by Avalanche if exploitation is suspected, including service-account credentials and device-management credentials.
• Harden the Avalanche service account with least privilege and verify filesystem permissions prevent arbitrary writes to executable locations.
• Add SIEM and WAF detections for traversal sequences and encoded traversal payloads targeting Avalanche endpoints.