CVE-2024-29204: 
Ivanti Avalanche vulnerability analysis and mitigation

A critical Heap Overflow vulnerability (CVE-2024-29204) was discovered in the WLAvalancheService component of Ivanti Avalanche before version 6.4.3. The vulnerability, disclosed on April 16, 2024, allows remote unauthenticated attackers to execute arbitrary commands on the underlying Windows system. The flaw has been assigned a CVSS score of 9.8, indicating its critical severity (Arctic Wolf, Help Net Security).

The vulnerability is caused by a heap-based buffer overflow issue within the WLAvalancheService.exe. The service allows file data upload through RSPFILEUPLOAD and RSPFILEUPLOAD_CONT messages, with compressed file data stored in the 'p.parcel' property. An attacker can exploit this by specifying abnormally large decompressed sizes in multiple messages, leading to an int32 overflow. This overflow results in a heap-based buffer overflow when decompressed data exceeds the allocated buffer size, enabling arbitrary code execution (Security Online).

Successful exploitation of this vulnerability could lead to severe consequences including data theft through exfiltration of sensitive information like device data and user credentials, deployment of ransomware that could disrupt operations, and network intrusion by using compromised devices as a gateway for lateral movement within corporate networks (Security Online).

Ivanti strongly recommends upgrading to Avalanche version 6.4.3, which contains the fix for this vulnerability. No alternative mitigations have been provided by the vendor. Organizations should follow their standard patching and testing procedures to avoid operational impact (Arctic Wolf, SOCRadar).

Ivanti has stated that they are not aware of any customers being exploited by this vulnerability prior to its public disclosure. The disclosure comes during a challenging period for Ivanti, as the company has faced multiple security issues with their enterprise solutions in recent months, leading to increased efforts to improve product security, customer support, and information sharing (Help Net Security).