CVE-2024-24992

What it actually does

The flaw is a path traversal issue in a web component that can allow a remote authenticated user to escape intended file/path boundaries and reach functionality that results in arbitrary command execution. On affected Windows deployments, successful exploitation can execute commands with SYSTEM privileges, giving the attacker full control of the application host. The vulnerability is network reachable, requires low privileges, requires no user interaction, and has high confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised system can be fully taken over, allowing attackers to steal sensitive data, alter application behavior, deploy malware, disrupt operations, and use the host as a foothold for lateral movement. Although it is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the EPSS score is high, meaning broad exploitation likelihood should be treated as significant. Because the issue has been public for over two years, exposed unpatched systems should be considered at elevated risk.

How an attack unfolds

An attacker first obtains valid low-privileged credentials for the affected web component, either through credential theft, password spraying, reuse of leaked credentials, or abuse of an existing account. The attacker then sends crafted authenticated HTTP requests containing path traversal sequences such as dot-dot-slash or encoded equivalents to access paths or operations outside the intended web root. If the vulnerable component processes the supplied path unsafely, the attacker can cause the application to invoke operating system commands. Because the vulnerable service can run with high privileges, the commands may execute as SYSTEM. The attacker typically validates execution with simple commands, downloads or stages tooling, establishes persistence, collects credentials, and pivots to other internal systems.

How to fix it

Upgrade affected software to a fixed release immediately. For Ivanti Avalanche deployments, upgrade to version 6.4.3 or later if applicable. For the listed affected Git package, update ikoniaris/kippo-graph to commit e6587ec598902763110b70c8bd0a72f7951b4997 or a later trusted revision. Remove direct internet exposure where possible, restrict access to trusted administrative networks or VPNs, enforce strong authentication, rotate credentials for accounts that could authenticate to the web component, and ensure the service runs with the least privileges possible. If immediate patching is not possible, place the service behind access controls, block traversal patterns at a reverse proxy or WAF, disable vulnerable functionality if supported, and increase monitoring for authenticated anomalous requests and child process creation from the web service.

How to confirm the fix worked

Confirm the installed product version or package revision is no longer vulnerable: Ivanti Avalanche should report 6.4.3 or later where applicable, and ikoniaris/kippo-graph should include commit e6587ec598902763110b70c8bd0a72f7951b4997 or later. Review software bill of materials, package lock files, container images, deployment manifests, and running service versions to ensure no older component remains deployed. Perform an authenticated negative test in a non-production or approved test environment using benign traversal payloads and verify the application rejects or normalizes them without accessing unintended paths or spawning operating system processes. Validate compensating controls by confirming administrative interfaces are not publicly reachable and that WAF or reverse proxy rules log and block encoded traversal attempts.

Typical attack path

1. Identify an internet-exposed or internally reachable affected web component.
2. Acquire or compromise a valid low-privileged user account.
3. Authenticate to the web interface or API.
4. Send crafted requests containing path traversal payloads such as ../, ..\, or encoded variants.
5. Trigger command execution through the vulnerable path handling behavior.
6. Run discovery commands to confirm privilege level and host context.
7. Download payloads or execute built-in administrative tools.
8. Establish persistence, collect credentials, exfiltrate data, or move laterally.

How to detect it

Look for evidence of authenticated requests containing path traversal sequences and for operating system commands launched by the web application process. Relevant sources include web access logs, application audit logs, authentication logs, reverse proxy or WAF logs, Windows Security logs, Sysmon telemetry, EDR process trees, PowerShell Operational logs, scheduled task logs, service creation logs, and network egress logs. Focus on successful authenticated requests with ../, ..\, double-encoded traversal, unusual file path parameters, unexpected HTTP 200/500 responses after traversal attempts, and subsequent process creation as NT AUTHORITY\SYSTEM. On Windows, investigate cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl.exe, or net.exe spawned by the web service or application server process. Also review for new local users, newly created services, suspicious scheduled tasks, outbound connections to unfamiliar hosts, dropped executables in temporary or web-accessible directories, and credential dumping behavior after the suspected request window.

• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• cmd.exe /c
• powershell.exe -EncodedCommand
• powershell.exe -enc
• whoami /all
• NT AUTHORITY\SYSTEM
• certutil.exe -urlcache
• bitsadmin /transfer
• curl.exe http
• wget.exe http
• net user
• net localgroup administrators
• schtasks /create
• sc.exe create
• reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• mimikatz
• procdump.exe -ma lsass.exe
• Windows Event ID 4688
• Sysmon Event ID 1
• Microsoft-Windows-PowerShell/Operational Event ID 4104

What your security team should do

• Treat exposed affected systems as high priority because the vulnerability enables authenticated remote command execution as SYSTEM and has a high EPSS probability.
• Patch or upgrade affected deployments immediately, prioritizing internet-facing and broadly reachable management interfaces.
• Verify whether the environment contains Ivanti Avalanche before 6.4.3 or the listed vulnerable ikoniaris/kippo-graph Git revision; resolve any asset-inventory mismatch before closing the issue.
• Restrict web component access to trusted administrative networks and require MFA for accounts that can authenticate to it.
• Rotate credentials for users with access to the affected interface, especially if suspicious requests or process creation are found.
• Hunt for path traversal payloads in web logs and for command shells or scripting engines spawned by the vulnerable web service account.
• Review Windows Event ID 4688, Sysmon Event ID 1, PowerShell logs, EDR telemetry, and application logs for evidence of post-exploitation activity.
• If compromise is suspected, isolate the host, preserve logs and forensic artifacts, collect memory and disk evidence where appropriate, and rebuild from trusted media after credential rotation.