CVE-2024-13179

What it actually does

CVE-2024-13179 is a remote unauthenticated path traversal vulnerability in Ivanti Avalanche before version 6.4.7. By submitting specially crafted requests containing directory traversal sequences, an attacker can cause the server to access resources outside the intended web/application path and bypass authentication controls. Because the issue is remotely reachable and does not require credentials, it can expose protected application functionality or files and may enable follow-on compromise depending on the deployment and accessible resources.

Why it matters to the business

An exposed vulnerable Ivanti Avalanche server can be accessed by an unauthenticated attacker, creating a high risk of unauthorized administration, data exposure, service disruption, or compromise of systems managed through Avalanche. The CVSS score is critical and EPSS is high, meaning exploitation is considered plausible even though it is not currently listed in CISA KEV and no ransomware use is reported. Organizations using Avalanche broadly for mobile/device management should treat this as urgent because compromise of a management platform can have outsized operational impact.

How an attack unfolds

An attacker first identifies an internet-facing or network-accessible Ivanti Avalanche instance running a version earlier than 6.4.7. They then send crafted HTTP requests that include path traversal patterns such as ../ or encoded equivalents in URL paths or parameters. If the server fails to normalize and constrain the requested path before authorization checks, the request can reach protected resources without a valid session. After bypassing authentication, the attacker may enumerate accessible endpoints, retrieve sensitive files or application data, and attempt additional actions against the Avalanche management interface or connected device-management workflows.

How to fix it

Upgrade Ivanti Avalanche to version 6.4.7 or later. If immediate upgrade is not possible, restrict access to Avalanche administrative and web interfaces using VPN, firewall rules, IP allowlisting, and network segmentation; remove direct internet exposure; and monitor or block requests containing traversal patterns. Ensure reverse proxies and WAFs normalize URL encoding before applying traversal rules, because attackers commonly use encoded or double-encoded variants. Review Ivanti advisories for any additional hardening guidance, hotfixes, or post-upgrade validation steps.

How to confirm the fix worked

Confirm the installed Ivanti Avalanche version is 6.4.7 or later on all servers. Validate that Avalanche management interfaces are not directly internet-exposed unless explicitly required and protected by strong access controls. Review web, reverse proxy, WAF, and application logs for traversal attempts and unauthenticated access to normally protected paths. Where safe and authorized, perform a controlled test using benign traversal payloads to verify that requests are rejected with an appropriate error and do not return protected content. Confirm WAF or proxy rules detect encoded traversal variants such as %2e%2e%2f and double-encoded forms.

Typical attack path

1. Discover Ivanti Avalanche services exposed to the internet or reachable from an internal network.
2. Fingerprint the service version or behavior to determine whether it is likely earlier than 6.4.7.
3. Send crafted HTTP requests containing directory traversal sequences such as ../, ..\, or URL-encoded variants.
4. Use the traversal behavior to bypass authentication and access protected resources or functionality.
5. Enumerate files, endpoints, configuration data, or management features reachable after the bypass.
6. Use any recovered credentials, tokens, configuration secrets, or administrative access to expand control or perform follow-on activity.

How to detect it

To determine whether exploitation has already occurred, review HTTP access logs from Ivanti Avalanche, web servers, reverse proxies, load balancers, and WAFs for requests containing directory traversal patterns. Look for unauthenticated requests that return successful HTTP status codes to paths that normally require login, especially followed by enumeration of application endpoints, configuration files, or administrative functions. Search for raw, encoded, double-encoded, and Windows-style traversal strings in URI paths, query strings, and request bodies. Correlate suspicious requests with authentication logs to identify access to protected resources without a corresponding valid login. Investigate repeated 400/401/403 responses followed by 200 responses from the same source, unusual user agents, high-volume probing, or requests from scanning infrastructure. If suspicious access is found, preserve logs, capture relevant request/response metadata, review application and operating-system events for file access or configuration changes, and assess whether credentials or secrets accessible to Avalanche require rotation.

• ../
• ..\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %2e%2e%5c
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• /../
• \..\
• %c0%ae%c0%ae%c0%af
• %uff0e%uff0e%u2215
• GET /..
• POST /..
• GET %2f..
• POST %2f..

What your security team should do

• Patch all Ivanti Avalanche deployments to version 6.4.7 or later as a priority.
• Immediately restrict network access to Avalanche administrative interfaces, especially any internet-facing instances.
• Search historical web, proxy, WAF, and application logs for path traversal payloads and unauthenticated access to protected Avalanche resources.
• Create or tune detections for traversal sequences in requests to Avalanche, including URL-encoded and double-encoded variants.
• After patching, review Avalanche configuration, local files, accounts, credentials, and integrations for signs of unauthorized access or tampering.
• Rotate credentials or secrets stored in or used by Avalanche if logs indicate likely exploitation or protected file access.
• Track EPSS and vendor intelligence for changes in exploitation maturity, proof-of-concept availability, or inclusion in known exploited vulnerability catalogs.