CVE-2024-24999: 
Ivanti Avalanche vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2024-24999) was discovered in the web component of Ivanti Avalanche before version 6.4.3. The vulnerability affects the WLAvalancheService, which listens on TCP port 1777 by default. This security flaw allows a remote authenticated attacker to execute arbitrary commands with SYSTEM privileges (ZDI Advisory, NVD).

The vulnerability stems from insufficient validation of user-supplied paths prior to their use in file operations. It has been assigned a CVSS v3.0 base score of 8.8 (HIGH) with the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

Successful exploitation of this vulnerability allows authenticated attackers to execute arbitrary code with SYSTEM privileges on affected installations of Ivanti Avalanche. This level of access could potentially allow attackers to fully compromise the affected system (ZDI Advisory).

The vulnerability requires authentication for exploitation. As of current reports, there are no known instances of this vulnerability being exploited in the wild (CIS Advisory).

Ivanti has released version 6.4.3 to address this vulnerability. Organizations using affected versions of Ivanti Avalanche should upgrade to version 6.4.3 or later (Ivanti Forums).