CVE-2023-32563
published 2023-08-10CVE-2023-32563: An unauthenticated attacker could achieve the code execution through a RemoteControl server.
PriorityP194critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
90.17%
99.8th percentile
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ivanti | avalanche | < 6.4.1 | 6.4.1 |
Detection & IOCsextracted from sources · hover to see the quote
urlPOST /Servlet/Skins HTTP/1.1
path/Servlet/Skins
path../../../Web/webapps/ROOT
filename{{randstr}}.jsp
- →Exploit sends a multipart POST to /Servlet/Skins with a path-traversal 'guid' field value of '../../../Web/webapps/ROOT' to drop a JSP webshell into the Tomcat ROOT directory.
- →The 'guid' multipart field is abused for directory traversal; monitor for values containing '../' sequences targeting web application directories.
- →After upload, attacker performs a GET request to the dropped JSP file at the web root to trigger remote code execution; monitor for GET requests to newly created .jsp files at the root path.
- →Exploitation is unauthenticated (no auth headers required); alert on POST requests to /Servlet/Skins from unauthenticated sessions containing multipart file uploads with .jsp filenames. ↗
- →The vulnerability is classified as CWE-22 (Path Traversal); the 'guid' parameter is the traversal vector in the /Servlet/Skins endpoint.
- ·The nuclei template uses a random string ({{randstr}}) for the uploaded JSP filename, meaning the exact filename will vary per exploitation attempt; detection should focus on the pattern of .jsp file uploads via /Servlet/Skins rather than a static filename.
- ·The template requires 2 HTTP requests (upload + trigger); both the POST to /Servlet/Skins and the subsequent GET to the dropped JSP are needed for full exploitation confirmation.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-59v5-hxjr-qjqr: An unauthenticated attacker could achieve the code execution through a RemoteControl server
ghsa_unreviewed·2023-08-10
CVE-2023-32563 [HIGH] CWE-22 GHSA-59v5-hxjr-qjqr: An unauthenticated attacker could achieve the code execution through a RemoteControl server
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
VulnCheck
Ivanti avalanche Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2023·CVSS 9.8
CVE-2023-32563 [CRITICAL] Ivanti avalanche Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Ivanti avalanche Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
Affected: Ivanti avalanche
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-32563; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-04&host_type=src&vulnerability=cve-2023-32563; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-10&host_type=src&vulnerability=cve-2023-32563;
Ivanti
Ivanti Security Advisory: CVE-2023-32563
vendor_ivanti·2023-08-10·CVSS 9.8
CVE-2023-32563 [CRITICAL] CWE-22 Ivanti Security Advisory: CVE-2023-32563
Ivanti Security Advisory: CVE-2023-32563
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
CVE IDs: CVE-2023-32563
CVSS Base Score: 9.8
Severity: CRITICAL
CWEs: CWE-22
No detection rules found.
Nuclei
Ivanti Avalanche - Remote Code Execution
nuclei·CVSS 9.8
CVE-2023-32563 [CRITICAL] Ivanti Avalanche - Remote Code Execution
Ivanti Avalanche - Remote Code Execution
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
Template:
id: CVE-2023-32563
info:
name: Ivanti Avalanche - Remote Code Execution
author: princechaddha
severity: critical
description: An unauthenticated attacker could achieve the code execution through a RemoteControl server.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Apply the latest security patches or updates provided by Ivanti to mitigate this vulnerability.
reference:
- https://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939
- https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
- https://nvd.nist
No writeups or analysis indexed.
https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_UShttps://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_UShttps://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939
2023-08-10
Published
Exploited in the wild