CVE-2024-29848

What it actually does

CVE-2024-29848 is an authenticated remote code execution vulnerability in the web component of Ivanti Avalanche versions before 6.4.x. A user who already has privileged access to the application can upload files without sufficient restriction and use that upload path to execute arbitrary commands on the underlying Windows host. Successful exploitation results in command execution as NT AUTHORITY\SYSTEM, giving the attacker full local control of the Avalanche server, including the ability to read or modify data, install tools, create persistence, pivot to connected systems, and disrupt service availability.

Why it matters to the business

If exploited, this vulnerability can turn a compromised or malicious privileged Avalanche account into full server takeover. Because Avalanche is commonly used to manage mobile and endpoint devices, compromise of the server can affect device management operations, software distribution, configuration integrity, and trust in managed endpoints. The CVSS score is high and the EPSS score is elevated, indicating meaningful likelihood of exploitation, even though it is not currently listed in CISA KEV and no ransomware association is reported. Organizations running Ivanti Avalanche before 6.4.x should treat remediation as high priority, especially where administrative access is exposed to broad user groups or reachable over untrusted networks.

How an attack unfolds

An attacker first obtains authenticated privileged access to Ivanti Avalanche, either through stolen credentials, phishing, credential reuse, insider access, or compromise of an administrator workstation. The attacker then accesses the vulnerable web component and uploads a crafted file that bypasses expected file-type or path restrictions. Because the application does not adequately restrict uploaded content, the attacker can place or invoke content in a way that causes the Avalanche server to execute attacker-controlled commands. Those commands run as SYSTEM on the Windows server, allowing the attacker to add accounts, deploy malware or remote access tooling, dump credentials, tamper with Avalanche-managed assets, and use the server as a platform for lateral movement.

How to fix it

Upgrade Ivanti Avalanche to version 6.4.x or later. If an exact vendor patch level is available for the deployed branch, apply the latest supported 6.4.x release rather than only the minimum fixed version. Until upgraded, restrict access to the Avalanche web interface to trusted administrative networks, enforce MFA for administrative users where supported, review and reduce privileged user membership, disable or tightly control file-upload functionality if operationally feasible, and monitor for suspicious uploads or command execution from the Avalanche application context. Because exploitation requires privileged authentication, credential hygiene and administrative access control are important compensating controls but should not be considered a substitute for patching.

How to confirm the fix worked

Confirm the deployed Ivanti Avalanche version is 6.4.x or later using the product administration interface, installed application metadata, or vendor-supported version-check method. Verify that all Avalanche web components have been upgraded, not just management consoles or agents. Review exposure by confirming the web interface is not reachable from untrusted networks and that only intended privileged users can authenticate. After patching, attempt to reproduce the vulnerable upload behavior in a test or staging instance using a benign file type and confirm that unauthorized executable content cannot be uploaded or invoked. Validate that endpoint protection, application logs, and Windows auditing capture web-server-spawned process execution attempts.

Typical attack path

1. Obtain credentials for a privileged Ivanti Avalanche user account.
2. Authenticate to the Avalanche web interface over the network.
3. Use the vulnerable web component to upload a crafted file or payload.
4. Trigger execution of the uploaded content or an associated command path.
5. Gain command execution on the Avalanche server as NT AUTHORITY\SYSTEM.
6. Establish persistence, collect credentials, access Avalanche-managed data, or pivot to other internal systems.

How to detect it

To determine whether exploitation already occurred, review Ivanti Avalanche application and web access logs for authenticated privileged users performing unusual upload actions, especially uploads followed by errors, script execution, or administrative changes. Correlate upload events with Windows Security, Sysmon, EDR, and application server telemetry for child processes spawned by the Avalanche web component or related services. Look for command interpreters, PowerShell, scripting engines, archive utilities, or remote access tools launched from the web/application service context. Examine web-accessible upload directories and Avalanche application directories for recently created executable, script, JSP/ASP/ASPX-like, or otherwise unexpected files. Review Windows artifacts for persistence such as new services, scheduled tasks, local administrator changes, Run keys, and firewall rule changes. Investigate suspicious outbound network connections from the Avalanche server after privileged logins or upload events. Because no public exploit indicators or named threat actor patterns are provided, detection should focus on behavioral evidence of authenticated upload abuse and SYSTEM-level post-exploitation activity.

• NT AUTHORITY\SYSTEM spawning cmd.exe
• NT AUTHORITY\SYSTEM spawning powershell.exe
• NT AUTHORITY\SYSTEM spawning pwsh.exe
• NT AUTHORITY\SYSTEM spawning wscript.exe
• NT AUTHORITY\SYSTEM spawning cscript.exe
• NT AUTHORITY\SYSTEM spawning mshta.exe
• NT AUTHORITY\SYSTEM spawning rundll32.exe
• NT AUTHORITY\SYSTEM spawning regsvr32.exe
• cmd.exe /c whoami
• whoami /all
• powershell.exe -enc
• powershell.exe -EncodedCommand
• Invoke-WebRequest
• System.Net.WebClient
• certutil.exe -urlcache
• bitsadmin /transfer
• schtasks /create
• sc.exe create
• net user
• net localgroup administrators
• New-LocalUser
• Add-LocalGroupMember
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Patch or upgrade Ivanti Avalanche to 6.4.x or later as a high-priority change.
• Immediately restrict Avalanche administrative web access to VPN, bastion hosts, or trusted management networks only.
• Audit privileged Avalanche accounts for unnecessary access, stale users, shared accounts, and weak authentication controls.
• Review logs for suspicious file uploads and process execution from Avalanche or its web service account, especially since the vulnerability was published.
• Rotate credentials for privileged Avalanche accounts if there are signs of suspicious access or if account compromise is suspected.
• Hunt for post-exploitation activity on the Avalanche server, including new local administrators, scheduled tasks, services, web-accessible payloads, credential dumping tools, and unusual outbound connections.
• Ensure reliable backups and recovery procedures exist for the Avalanche server and its configuration data before and after remediation.