PT-2022-10018 · Ivanti · Ivanti Avalanche

Ahmed Y. Elmogy · Published 2022-04-06 · Updated 2022-04-13 · CVE-2021-30497

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche (Premise) version 6.3.2

Description The issue allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. This is due to the imageFilePath parameter not being verified to be within the scope of the image folder when processed by the "/AvalancheWeb/image" endpoint. An attacker can obtain sensitive information by exploiting this, for example, by accessing the "C:/Windows/system32/config/system.sav" file.

Recommendations For Ivanti Avalanche (Premise) version 6.3.2, as a temporary workaround, consider restricting access to the "/AvalancheWeb/image" endpoint to minimize the risk of exploitation. Additionally, avoid using the imageFilePath parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-30497

Affected Products

Ivanti Avalanche

References · 5

• 🔥 https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal · Exploit
• https://osv.dev/vulnerability/CVE-2021-30497 · Vendor Advisory
• https://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US · Vendor Advisory
• https://help.ivanti.com/wl/help/en_us/aod/5.4/Avalanche/Console/Launching_the_Avalanche.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30497 · Security Note