CVE-2022-36982

What it actually does

CVE-2022-36982 is a path traversal vulnerability in Ivanti Avalanche 6.3.3.101, specifically in the AgentTaskHandler class. The application uses attacker-controlled path input in file operations without sufficient canonicalization, normalization, or directory-boundary enforcement. Although the vulnerable functionality is described as requiring authentication, the product’s authentication mechanism can be bypassed, making the practical impact equivalent to unauthenticated remote arbitrary file read. Successful exploitation can expose sensitive local files accessible to the Avalanche service account, including stored session cookies, configuration files, credentials, logs, and other application data. The primary direct impact is confidentiality loss, but disclosure of valid session material can enable follow-on authenticated compromise of the Avalanche management environment.

Why it matters to the business

An attacker who can reach the Ivanti Avalanche service may be able to steal sensitive files without valid credentials, including session cookies that could let them impersonate users or administrators. This can lead to compromise of mobile device management or warehouse/device-management operations, exposure of configuration secrets, unauthorized administrative access, and broader intrusion into managed infrastructure. The CVSS score is high and the EPSS score is elevated, indicating meaningful likelihood of exploitation activity even though this vulnerability is not currently listed in CISA KEV and is not known to be ransomware-associated. Organizations using Ivanti Avalanche should treat exposed or unpatched 6.3.3.101 installations as high-risk, especially if reachable from untrusted networks.

How an attack unfolds

An attacker first identifies an exposed Ivanti Avalanche deployment running an affected version. They then target the vulnerable AgentTaskHandler functionality and supply crafted path values containing traversal sequences or encoded traversal characters. Because the application does not properly validate or constrain the requested path, the file operation resolves outside the intended directory. The attacker uses the authentication bypass to reach this code path without valid credentials, then reads sensitive files from the server filesystem. High-value targets include application configuration, logs, credential stores, and session-cookie data. If session cookies or other authentication artifacts are recovered, the attacker can replay or reuse them to access the Avalanche administrative interface, enumerate managed devices and policies, alter configurations, or pivot further into the environment depending on privileges and network placement.

How to fix it

Upgrade Ivanti Avalanche to a vendor-supported release that fixes CVE-2022-36982. The supplied fixed-version data does not identify an exact patched version, so administrators should consult Ivanti’s advisory and release notes and move off Avalanche 6.3.3.101 or any other vulnerable build. If immediate patching is not possible, restrict access to the Avalanche management interface to trusted administrative networks or VPN users only, block internet exposure, and enforce network-layer allowlisting. Review and harden service-account filesystem permissions so the Avalanche process cannot read unnecessary sensitive files. Rotate Avalanche session keys, invalidate active sessions, and rotate any credentials or secrets that may have been stored in files accessible to the application. Monitor for suspicious file-read attempts and session reuse from unexpected sources until patching is complete.

How to confirm the fix worked

Confirm the deployed Ivanti Avalanche version is no longer 6.3.3.101 and matches a vendor-supported patched release. Validate that the Avalanche management interface is not exposed to untrusted networks and that access controls are enforced at the firewall, reverse proxy, or VPN layer. Perform an authenticated and unauthenticated security test using benign traversal payloads to verify that requests cannot read files outside intended application directories and that authentication bypass is not possible. Review application behavior to ensure traversal inputs are rejected, normalized safely, and logged. Confirm all active sessions were invalidated after remediation and that rotated credentials or secrets are in use. Use vulnerability scanners or configuration management inventory to ensure no affected Ivanti Avalanche instances remain.

Typical attack path

1. Discover an exposed Ivanti Avalanche service and fingerprint the version or behavior as consistent with an affected release.
2. Send crafted requests to AgentTaskHandler using path traversal payloads such as dot-dot-slash sequences or encoded equivalents.
3. Bypass the intended authentication requirement and trigger server-side file read operations.
4. Retrieve sensitive local files accessible to the Avalanche application service account.
5. Extract session cookies, credentials, configuration secrets, or operational data from the retrieved files.
6. Reuse stolen session material or credentials to access Avalanche functionality as a legitimate user or administrator.
7. Perform follow-on actions such as device-management changes, data collection, persistence, or lateral movement depending on obtained privileges.

How to detect it

To determine whether exploitation already occurred, review Ivanti Avalanche application logs, web server logs, reverse proxy logs, WAF alerts, EDR telemetry, and authentication/session logs for requests to AgentTaskHandler containing traversal sequences or encoded path manipulation. Focus on requests that include attempts to access sensitive files such as configuration files, logs, password files, Windows system files, or application session stores. Look for successful HTTP responses with unusually large file-like payloads, repeated probing of different file paths, requests made without valid prior authentication, and access from unfamiliar source IPs. After any suspicious file-read activity, examine authentication logs for session reuse, administrative actions from unusual IP addresses, impossible travel, new administrative users, policy changes, device-management changes, or configuration exports. On the host, review EDR and file-access telemetry for the Avalanche service process reading unexpected files outside its normal application directories. Because the vulnerability can expose session cookies, absence of failed logins does not rule out compromise; investigate anomalous valid-session activity following suspected traversal attempts.

• AgentTaskHandler
• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• C:\Windows\win.ini
• C:\Windows\System32\drivers\etc\hosts
• WEB-INF/web.xml
• session cookie
• JSESSIONID

What your security team should do

• Inventory all Ivanti Avalanche deployments and identify any running version 6.3.3.101 or other vulnerable builds.
• Prioritize patching or upgrading affected systems, especially any instance reachable from the internet or broad internal networks.
• Immediately restrict Avalanche administrative access to trusted networks, VPNs, or allowlisted administrative hosts until remediation is verified.
• Search historical web, proxy, WAF, and Avalanche application logs for traversal payloads, AgentTaskHandler access, suspicious file-read attempts, and anomalous session activity.
• Invalidate existing Avalanche sessions and rotate administrative credentials, service credentials, API keys, and secrets that may have been stored on the application server.
• Review filesystem permissions for the Avalanche service account and remove unnecessary read access to sensitive operating-system and application files.
• Create SIEM detections for path traversal strings and encoded traversal attempts against Avalanche endpoints.
• If suspicious access is found, perform incident response scoping for session hijacking, unauthorized administrative actions, configuration changes, and lateral movement from the Avalanche server.