CVE-2023-28127

What it actually does

CVE-2023-28127 is a path traversal vulnerability in Ivanti Avalanche 6.3.x and earlier. A remote unauthenticated attacker can craft requests containing traversal sequences that cause the application to resolve file paths outside the intended directory. The primary technical impact is high confidentiality loss through unauthorized file disclosure; the CVSS vector indicates network exploitability, low attack complexity, no required privileges, no required user interaction, unchanged scope, high confidentiality impact, and no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose sensitive files from an Ivanti Avalanche server, potentially including configuration files, application metadata, credentials, certificates, database connection details, logs, or other operational information stored on the host. That information can support follow-on compromise of device-management infrastructure or connected systems. Although this CVE is not listed in CISA KEV and is not marked as ransomware-associated, the EPSS score is elevated, so internet-exposed or broadly reachable Avalanche deployments should be treated as priority remediation targets.

How an attack unfolds

An attacker identifies an Ivanti Avalanche instance running version 6.3.x or earlier and sends crafted HTTP requests containing path traversal sequences. Because the vulnerable component does not properly normalize or restrict file paths, the attacker can escape the intended application directory and request files elsewhere on the server. The attacker iterates through common operating system, web application, and Avalanche-related file paths to retrieve sensitive data. The disclosed information may then be used to map the environment, extract secrets, identify database or service credentials, or plan additional attacks against Avalanche-managed infrastructure or adjacent systems.

How to fix it

Upgrade Ivanti Avalanche deployments running 6.3.x or earlier to a vendor-supported release that Ivanti documents as fixed for this issue; no exact fixed version was provided in the input, so confirm the corrected version against the official Ivanti advisory before closing remediation. If immediate upgrade is not possible, restrict Avalanche access to trusted administrative networks or VPNs, block internet exposure, enforce authentication and network-layer access controls, and deploy WAF or reverse-proxy rules that deny path traversal patterns such as ../, encoded dot-dot-slash sequences, and Windows backslash traversal. Reduce impact by running Avalanche services with least-privilege filesystem permissions and ensuring sensitive files are not readable by the application service account unless required.

How to confirm the fix worked

Confirm that all Avalanche instances have been upgraded from affected 6.3.x-and-earlier versions to a vendor-confirmed fixed release. Perform controlled testing from an untrusted network path using benign traversal payloads that attempt to read non-sensitive known files and verify the application returns a denial, normalized error, or not-found response rather than file contents. Validate that reverse-proxy or WAF controls block plain, URL-encoded, double-encoded, and backslash traversal variants. Re-scan externally exposed services to confirm Avalanche is not reachable from unauthorized networks and review service account permissions to ensure the application cannot read unnecessary sensitive files.

Typical attack path

1. Discover an exposed Ivanti Avalanche service and fingerprint the version or behavior.
2. Send crafted HTTP requests containing path traversal sequences such as ../ or URL-encoded variants.
3. Use response codes, response sizes, and returned content to determine whether file reads are successful.
4. Request common sensitive files from the operating system, application server, and Avalanche deployment.
5. Extract useful information such as configuration data, secrets, usernames, database connection details, logs, or certificates.
6. Use the disclosed information for reconnaissance, credential attacks, lateral movement, or follow-on exploitation.

How to detect it

Review web server, reverse proxy, WAF, load balancer, and Ivanti Avalanche application logs for path traversal probes or successful file reads. Focus on requests containing dot-dot-slash sequences, URL-encoded traversal characters, double-encoded traversal characters, Windows path separators, or attempts to retrieve known sensitive files such as /etc/passwd, win.ini, WEB-INF/web.xml, application configuration files, keystores, logs, or database configuration files. Prioritize events with HTTP 200, 206, or unusually large response sizes, especially from unauthenticated sources. Correlate suspicious requests with subsequent authentication anomalies, administrative access, configuration changes, unusual outbound connections, or access to files outside expected web/application directories. If exploitation is suspected, preserve access logs, application logs, filesystem timestamps, and memory/process evidence before remediation where feasible.

• ../
• ..\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %2e%2e%5c
• ..%5c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /windows/win.ini
• C:\Windows\win.ini
• WEB-INF/web.xml
• application.properties
• database.properties
• server.xml

What your security team should do

• Inventory all Ivanti Avalanche deployments and identify any instance running version 6.3.x or earlier.
• Prioritize remediation for internet-facing or broadly reachable Avalanche servers because the vulnerability is remotely exploitable without authentication and has an elevated EPSS score.
• Upgrade to a vendor-confirmed fixed Avalanche release and verify the vulnerable version is no longer present.
• Until patched, restrict access to trusted networks and add WAF or reverse-proxy rules to block traversal payloads and encoded variants.
• Review historical access, proxy, WAF, and application logs for traversal indicators and successful responses before assuming the issue was only exposed, not exploited.
• If suspicious file disclosure is found, rotate potentially exposed credentials, certificates, API keys, database passwords, and service account secrets.
• Harden the Avalanche host by limiting service account file permissions and monitoring attempts to access sensitive OS or application files.