CVE-2024-23535

What it actually does

CVE-2024-23535 is a path traversal vulnerability in the Ivanti Avalanche web component before version 6.4.3. A remote authenticated attacker can manipulate file or path handling in the web interface to traverse outside intended directories and reach command-execution functionality or write/execute attacker-controlled content. Successful exploitation results in arbitrary command execution with SYSTEM privileges on the underlying Windows host, giving the attacker complete control over confidentiality, integrity, and availability of the Avalanche server.

Why it matters to the business

Compromise of an Ivanti Avalanche server can lead to full takeover of the management platform used for mobile device and warehouse/enterprise endpoint administration. Because commands run as SYSTEM, an attacker could disrupt device management operations, alter configurations, deploy malicious payloads, steal sensitive operational data, or use the server as a foothold for broader network compromise. The high EPSS score indicates meaningful likelihood of exploitation activity, so organizations running affected versions should treat remediation as urgent even though the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first obtains valid low-privileged credentials for the Ivanti Avalanche web interface, either through credential theft, password reuse, phishing, exposed accounts, or compromise of an adjacent system. After authenticating, the attacker sends crafted HTTP requests to the vulnerable web component containing path traversal sequences such as attempts to reference files or locations outside the expected web application directory. By abusing the vulnerable path handling, the attacker causes the server-side component to execute arbitrary commands. Because the affected service executes with elevated Windows privileges, those commands run as SYSTEM. The attacker can then establish persistence, create users, deploy tools, dump credentials, modify Avalanche-managed device configurations, or pivot to other internal systems.

How to fix it

Upgrade Ivanti Avalanche to version 6.4.3 or later. If immediate upgrade is not possible, restrict access to the Avalanche web interface to trusted administrative networks or VPNs, remove unnecessary internet exposure, enforce strong authentication and credential hygiene, review and reduce administrative privileges, and monitor the server closely for suspicious web requests and command execution. Because exploitation requires authentication, rotate credentials for Avalanche users and related service accounts if compromise is suspected. Ensure endpoint protection and logging are enabled on the Avalanche server before and after patching.

How to confirm the fix worked

Confirm the installed Ivanti Avalanche version is 6.4.3 or later. Verify the web interface is not reachable from untrusted networks unless explicitly required and protected by strong access controls. Review vendor release notes and file versions to ensure the patched web component is deployed. Where safe and authorized, use vulnerability scanning or a vendor-supported check to detect Avalanche versions earlier than 6.4.3. Validate that low-privileged authenticated users cannot access unintended file paths or trigger server-side command execution. After remediation, review logs for historical exploitation attempts and confirm no unexpected SYSTEM-level processes, scheduled tasks, services, or user accounts were created during the exposure window.

Typical attack path

1. Identify an internet-exposed or internally reachable Ivanti Avalanche web interface running a version earlier than 6.4.3.
2. Obtain valid credentials for the Avalanche web component through theft, reuse, phishing, or prior compromise.
3. Authenticate to the web interface.
4. Submit crafted requests containing path traversal payloads targeting the vulnerable web component.
5. Trigger arbitrary command execution on the server.
6. Run commands with SYSTEM privileges to stage payloads, create persistence, collect credentials, or alter management configurations.
7. Use the compromised Avalanche server to move laterally or impact managed devices and operational workflows.

How to detect it

Review Ivanti Avalanche application logs, web access logs, reverse proxy logs, Windows Event Logs, EDR telemetry, and network security logs for authenticated requests containing path traversal sequences followed by unusual process execution. Focus on activity from non-administrative accounts, unusual source IPs, new or rare user agents, and requests containing encoded or plain traversal strings. Correlate suspicious web requests with Windows process creation events where the parent process is an Avalanche, Java, Tomcat, IIS, or web service process spawning command interpreters or scripting tools. Look for SYSTEM-level execution of cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, rundll32.exe, regsvr32.exe, net.exe, net1.exe, schtasks.exe, sc.exe, or whoami.exe. Also hunt for newly created local users, new services, scheduled tasks, dropped executables or scripts in web-accessible directories, unexpected outbound connections from the Avalanche server, and modifications to Avalanche configuration or deployment packages. Since public threat actor attribution is not provided for this CVE, prioritize behavior-based detections rather than actor-specific indicators.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• cmd.exe
• powershell.exe
• pwsh.exe
• wscript.exe
• cscript.exe
• mshta.exe
• certutil.exe
• bitsadmin.exe
• rundll32.exe
• regsvr32.exe
• schtasks.exe
• sc.exe
• net.exe
• net1.exe
• whoami.exe
• Windows Event ID 4688
• Windows Event ID 4697
• Windows Event ID 7045
• Windows Event ID 4698
• Windows Event ID 4720
• Windows Event ID 4732
• NT AUTHORITY\\SYSTEM

What your security team should do

• Patch Ivanti Avalanche to version 6.4.3 or later as a high priority due to the high impact and elevated EPSS likelihood.
• Inventory all Avalanche deployments, including internal-only management servers, and confirm their versions and network exposure.
• Restrict Avalanche web access to trusted administrative sources and block direct internet exposure wherever possible.
• Audit Avalanche user accounts, remove stale accounts, enforce MFA where supported, and rotate credentials if suspicious activity is found.
• Hunt for path traversal patterns and suspicious authenticated web requests in Avalanche, web server, proxy, and EDR telemetry.
• Review Windows security, PowerShell, process creation, scheduled task, service creation, and antivirus logs on Avalanche servers for signs of SYSTEM-level command execution.
• Check for unauthorized changes to Avalanche configurations, managed device profiles, packages, and deployment tasks.
• If exploitation is suspected, isolate the server, preserve forensic evidence, rotate related credentials, and rebuild from trusted media after patching.