CVE-2024-24994

What it actually does

CVE-2024-24994 is an authenticated path traversal vulnerability in the web component of Ivanti Avalanche versions before 6.4.3. A remote attacker with valid low-privileged credentials can manipulate file path handling in the web interface to escape intended directories and reach execution paths that allow arbitrary operating-system command execution. Because the affected service can execute commands as NT AUTHORITY\SYSTEM, successful exploitation provides full control of the underlying Windows server, including the ability to read, modify, or delete data; create privileged users; install tools; disable services; and pivot to other systems reachable from the server.

Why it matters to the business

A compromised Ivanti Avalanche server can give an attacker control over a system used to manage mobile and wireless infrastructure, creating risk of operational disruption, credential theft, device-management abuse, malware deployment, and lateral movement into adjacent enterprise networks. Although this vulnerability is not currently listed in CISA KEV and has no confirmed ransomware association in the provided data, its CVSS score of 8.8 and EPSS score of 0.68104 indicate meaningful exploitation likelihood and warrant timely remediation, especially for internet-accessible or broadly reachable management consoles.

How an attack unfolds

An attacker first obtains valid credentials for the Ivanti Avalanche web interface through phishing, password reuse, credential stuffing, prior compromise, or abuse of an exposed account. After authenticating, the attacker sends crafted HTTP requests to the vulnerable web component containing path traversal sequences or encoded traversal variants that cause the application to access files or execution paths outside the intended directory. By reaching functionality that improperly handles those paths, the attacker can cause the server to execute attacker-controlled commands. Because the vulnerable component runs with high Windows privileges, those commands execute as SYSTEM. The attacker may then establish persistence, dump credentials, enumerate managed devices and network configuration, deploy remote-access tooling, disable logging or security controls, and use the Avalanche server as a staging point for broader intrusion activity.

How to fix it

Upgrade Ivanti Avalanche to version 6.4.3 or later, which is the vendor-fixed release for this vulnerability. If immediate upgrade is not possible, restrict access to the Avalanche web interface to trusted administrative networks or VPN users only, enforce multi-factor authentication where supported, review and reduce privileged application accounts, rotate credentials associated with the Avalanche server, and monitor closely for traversal and command-execution attempts. Do not expose the management interface directly to the internet. Because exploitation can result in SYSTEM-level compromise, any system suspected of exploitation should be treated as fully compromised and rebuilt or restored from known-good media after evidence collection and credential rotation.

How to confirm the fix worked

Confirm the installed Ivanti Avalanche version is 6.4.3 or later using the application console, vendor-supported version check, installed program inventory, or file/version metadata on the server. Verify that the web management interface is not reachable from untrusted networks. Review access control rules, reverse proxy configuration, and firewall policy to ensure only authorized administrative sources can reach the service. Validate that authentication is required for administrative web functions and that stale or shared accounts have been removed. Where safe and authorized, perform a controlled vulnerability assessment using an up-to-date scanner or vendor advisory checks to confirm the path traversal issue is no longer detected. After patching, review logs from the pre-patch exposure window for authenticated requests containing traversal strings, encoded traversal payloads, and suspicious post-authentication command execution artifacts.

Typical attack path

1. Identify an exposed or reachable Ivanti Avalanche web interface.
2. Acquire valid application credentials through phishing, reuse, credential stuffing, insider access, or a separate compromise.
3. Authenticate to the Avalanche web component.
4. Send crafted HTTP requests containing path traversal payloads, such as ../ or encoded traversal sequences, to reach unintended paths or command execution functionality.
5. Execute arbitrary commands on the underlying Windows host with SYSTEM privileges.
6. Run discovery commands to enumerate the host, domain context, service accounts, managed devices, and network reachability.
7. Create persistence through new accounts, scheduled tasks, services, web shells, or remote-management tools.
8. Dump credentials or tokens and attempt lateral movement to adjacent systems.
9. Cover tracks by clearing logs, deleting temporary files, or modifying service/application artifacts.

How to detect it

Look for evidence of authenticated exploitation in web server, reverse proxy, application, Windows security, PowerShell, Sysmon, and EDR logs. Focus on the period before upgrade to 6.4.3, and include any time when the web interface was externally reachable. In HTTP logs, search for requests from authenticated sessions containing path traversal patterns such as ../, ..\, URL-encoded dot-dot-slash sequences, double-encoded traversal, or attempts to reach Windows paths. Correlate suspicious requests with subsequent process creation on the Avalanche server, especially command shells or scripting utilities launched by the Avalanche service account or web service process. In Windows telemetry, investigate creation of new local users, changes to administrator group membership, scheduled task creation, new services, unexpected PowerShell execution, credential-dumping behavior, archive creation, and outbound connections to unfamiliar hosts. Also review Avalanche application logs for abnormal administrative actions, repeated failed logins followed by success, access from unusual geographies or networks, and actions performed by dormant or low-privileged accounts. Because public exploit maturity is not indicated in the provided data, avoid relying on a single exploit signature; use behavioral detections around traversal attempts followed by SYSTEM-level command execution.

• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/passwd
• C:\Windows\System32\cmd.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• whoami /all
• net user
• net localgroup administrators
• schtasks /create
• sc create
• certutil.exe -urlcache
• bitsadmin /transfer
• rundll32.exe
• regsvr32.exe
• wscript.exe
• cscript.exe

What your security team should do

• Prioritize upgrade of all Ivanti Avalanche deployments to 6.4.3 or later, especially systems exposed to the internet or accessible from large internal networks.
• Inventory all Avalanche instances, including test, disaster recovery, and legacy servers, and verify their versions and network exposure.
• Restrict access to the Avalanche web interface to trusted administrative networks and require VPN or equivalent access controls for remote administration.
• Audit Avalanche user accounts for weak, shared, dormant, or overprivileged credentials; rotate passwords and enable MFA where available.
• Review web access logs, application logs, Windows event logs, EDR telemetry, and proxy logs for traversal payloads and suspicious authenticated activity during the exposure period.
• Treat confirmed exploitation as SYSTEM-level host compromise: isolate the server, preserve forensic evidence, rotate credentials, review managed-device trust relationships, and rebuild if integrity cannot be assured.
• Create SIEM detections for authenticated requests containing path traversal sequences or encoded traversal variants against Avalanche web endpoints.
• Monitor for unusual child processes spawned by the Avalanche web/service process, such as command shells, PowerShell, certutil, bitsadmin, curl, or wget.
• Review outbound network connections from the Avalanche server for unexpected destinations, tunneling tools, or command-and-control behavior.
• Track vendor advisories for any additional Ivanti Avalanche fixes or post-release hardening guidance.