CVE-2023-32563

What it actually does

The flaw is a pre-authentication path traversal issue in the Ivanti Avalanche RemoteControl server that can be abused over the network without credentials or user interaction. By causing the server to resolve attacker-controlled paths outside the intended directory, an attacker may be able to place, overwrite, or access files in sensitive locations and then achieve arbitrary code execution in the security context of the Avalanche/RemoteControl service. With CVSS 9.8 and weaponized exploit maturity, successful exploitation can result in full confidentiality, integrity, and availability compromise of the affected Avalanche server.

Why it matters to the business

A compromised Avalanche server can give attackers control over a system used to manage mobile and warehouse/industrial endpoints, creating risk of operational disruption, device-management abuse, data exposure, credential theft, and lateral movement into adjacent enterprise systems. The very high EPSS score indicates exploitation is likely in the wild or highly probable, so internet-exposed or broadly reachable RemoteControl services should be treated as urgent even though the issue is not currently listed in CISA KEV and is not specifically tagged as ransomware-used.

How an attack unfolds

An attacker first identifies an Ivanti Avalanche deployment with the RemoteControl server reachable over the network. Without needing valid credentials, the attacker sends crafted requests containing path traversal sequences to make the RemoteControl component access filesystem locations outside its intended working directory. If the attacker can write or replace files in a location that the service later loads or executes, they can trigger code execution under the privileges of the Avalanche/RemoteControl service. After execution, the attacker may establish persistence, harvest credentials or configuration data, manipulate managed-device operations, deploy additional tooling, and use the server as a foothold for lateral movement.

How to fix it

Upgrade Ivanti Avalanche to a vendor-fixed version as soon as possible; Ivanti addressed this vulnerability in Avalanche 6.4.1 and later releases where applicable, so systems running 6.4.0 or earlier should be prioritized for upgrade. If immediate upgrade is not possible, restrict network access to the RemoteControl server to trusted management networks only, block internet exposure, enforce host firewall allowlists, place the service behind VPN or equivalent access controls, and monitor/block requests containing path traversal patterns. Review the Avalanche/RemoteControl service account privileges and reduce them where possible, rotate any credentials stored on or used by the server after patching, and consider rebuilding the host if exploitation is suspected.

How to confirm the fix worked

Confirm the installed Ivanti Avalanche version is a vendor-fixed release, preferably 6.4.1 or later where applicable. Verify the RemoteControl service is not exposed to the internet and is reachable only from authorized administrative networks. Review reverse proxy, web server, application, EDR, and host firewall logs for path traversal attempts and unexpected file modifications before and after remediation. Validate that requests containing encoded and unencoded traversal sequences are rejected and do not result in file access outside expected application directories. Confirm service binaries, startup entries, scheduled tasks, and application directories have not been modified unexpectedly.

Typical attack path

1. Scan for exposed Ivanti Avalanche RemoteControl services or identify them from banners, certificates, ports, or web paths.
2. Send unauthenticated requests containing traversal sequences such as ../, ..\, or URL-encoded variants to test whether filesystem boundaries can be bypassed.
3. Use the traversal behavior to access, write, or overwrite files outside the intended RemoteControl directory.
4. Place or modify a file that can be loaded or executed by the Avalanche/RemoteControl service.
5. Trigger the modified component or wait for the service to load it, resulting in code execution under the service account.
6. Establish persistence, collect configuration and credentials, enumerate managed devices, and move laterally to other reachable systems.

How to detect it

Review HTTP, reverse proxy, load balancer, WAF, and application logs for unauthenticated requests to Avalanche RemoteControl endpoints containing traversal sequences such as ../, ..\, double-encoded traversal, or attempts to reach Windows system paths. On the host, inspect Avalanche and RemoteControl installation directories for recently created or modified executables, DLLs, scripts, web content, archives, or configuration files that do not match a known-good baseline. Review Windows Security logs, Sysmon, EDR telemetry, and service logs for unexpected process creation by Avalanche/RemoteControl service processes, especially command shells, scripting engines, download utilities, archiving tools, or network discovery commands. Look for anomalous outbound connections from the Avalanche server after suspicious requests, new services or scheduled tasks, unusual service restarts, and changes to startup locations. Because public exploitation is weaponized and EPSS is high, absence of CISA KEV listing should not be treated as evidence of low risk.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• /RemoteControl/
• RemoteControl
• C:\\Program Files\\Wavelink\\Avalanche\\
• C:\\Program Files (x86)\\Wavelink\\Avalanche\\
• C:\\Program Files\\Ivanti\\Avalanche\\
• C:\\Program Files (x86)\\Ivanti\\Avalanche\\
• cmd.exe spawned by Avalanche or RemoteControl service
• powershell.exe spawned by Avalanche or RemoteControl service
• wscript.exe spawned by Avalanche or RemoteControl service
• cscript.exe spawned by Avalanche or RemoteControl service
• certutil.exe spawned by Avalanche or RemoteControl service
• bitsadmin.exe spawned by Avalanche or RemoteControl service
• rundll32.exe spawned by Avalanche or RemoteControl service
• regsvr32.exe spawned by Avalanche or RemoteControl service
• schtasks.exe spawned by Avalanche or RemoteControl service
• New service created shortly after RemoteControl request
• Scheduled task created shortly after RemoteControl request

What your security team should do

• Immediately inventory all Ivanti Avalanche servers and determine whether the RemoteControl component is enabled or reachable.
• Prioritize patching or upgrading Avalanche 6.4.0 and earlier systems because exploitation is weaponized and EPSS is very high.
• Remove internet exposure for RemoteControl services and restrict access to trusted management subnets or VPN-only paths.
• Search historical logs for traversal payloads and suspicious file writes around the RemoteControl service, especially on externally reachable systems.
• If indicators of exploitation are found, isolate the server, preserve forensic evidence, rotate credentials used by Avalanche, and rebuild from trusted media after applying the fixed version.
• Deploy SIEM detections for path traversal sequences targeting Avalanche/RemoteControl URLs and alert on suspicious child processes spawned by Avalanche or RemoteControl service processes.
• Review managed-device activity for unauthorized configuration changes, remote-control sessions, package deployments, or policy changes following any suspected compromise.