Ivanti Avalanche authentication bypass via path traversal
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authentication bypass vulnerabilities in Ivanti Avalanche before 6.4.7 allow unauthenticated remote attackers to gain system access.
Ivanti Avalanche, a mobile device management system, contains multiple path traversal vulnerabilities affecting all versions before 6.4.7. Two of these vulnerabilities (CVE-2024-13181 and CVE-2024-13179) allow remote unauthenticated attackers to bypass authentication entirely, while a third (CVE-2024-13180) enables sensitive information leakage. Successful exploitation permits an attacker to install programs, view, modify or delete data depending on the privileges of compromised accounts. Administrative accounts present significantly higher risk than standard user accounts.
No evidence of active exploitation has been reported as of the advisory date. The vendor has released patches in version 6.4.7, which should be applied immediately after testing. Mitigation strategies include applying the principle of least privilege, network segmentation to isolate critical systems, vulnerability scanning, and implementation of anti-exploitation protections where available.
Mentioned in this report
Detection guidance
Path Traversal Sequences in Successful Web Request
Detects HTTP requests with plain, URL-encoded or Tomcat-style (..;/) path traversal sequences that return HTTP 200, the pattern used to exploit path traversal authentication bypass in web management consoles such as Ivanti Avalanche. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequences in Successful Web Request
description: Detects web requests whose URI path or query contains directory traversal
sequences (plain, URL-encoded, double-encoded or Tomcat semicolon variants) and
that returned HTTP 200. Matches the technique class behind Ivanti Avalanche path
traversal authentication bypass (CVE-2024-13181, CVE-2024-13179) and information
leak (CVE-2024-13180). Does not depend on a specific endpoint, since none is published.
Tune by scoping to the MDM server's host or site name.
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_stem:
cs-uri-stem|contains:
- ../
- ..\
- ..;/
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%2e%2e%5c'
- ..%5c
- '%252e%252e'
selection_query:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- ..%2f
- '%2e%2e%5c'
- ..%5c
- '%252e%252e'
selection_status:
sc-status: 200
condition: 1 of selection_stem and selection_status or selection_query and selection_status
falsepositives:
- Vulnerability scanners run by the security team against internal web applications
- Web applications that legitimately pass relative paths in query parameters, for
example file download or report viewers
level: medium
id: eb8df06d-a39a-5191-a051-5a16c5733619
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-avalanche-could-allow-for-authentication-bypass_2025-005
Java or Tomcat Service Spawning Command Shell
Detects a Java or Tomcat service process spawning cmd.exe or PowerShell, a common post-exploitation indicator after a web-facing Java application such as an MDM server is compromised. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java or Tomcat Service Spawning Command Shell
description: Detects java.exe or Tomcat service processes spawning cmd.exe, powershell.exe
or pwsh.exe. After exploiting an authentication bypass on a Java-based management
console (for example Ivanti Avalanche), attackers can use it to install programs
or run commands. Scope to MDM and web application servers for best fidelity.
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat7.exe
- \tomcat8.exe
- \tomcat9.exe
- \tomcat10.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_version_check:
CommandLine|contains: -version
condition: selection and not filter_version_check
falsepositives:
- Java-based build or deployment tools that invoke shell scripts on the same host
- Application installers or updaters for Java software that shell out to cmd.exe
level: medium
id: e540fcca-e61b-5a3e-875a-20168f895820
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-avalanche-could-allow-for-authentication-bypass_2025-005
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-avalanche-could-allow-for-authentication-bypass_2025-005
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs