CVE-2024-22061

The vulnerability is a heap overflow in the WLInfoRailService component, which is part of the Ivanti Avalanche platform. An attacker can send a specially crafted network request without needing any credentials. The heap overflow leads to the possibility of executing arbitrary commands (command injection / RCE) in the context of the vulnerable service.

An attacker can remotely execute arbitrary system commands on a vulnerable server without authentication, which in practice means complete system takeover, data breach, and the ability to perform lateral movement within the network.

Ivanti Avalanche should be updated to version 6.4.3 or later. Detailed information about the patch is available in the vendor's official security notice: https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed

Ivanti Avalanche versions prior to 6.4.3