TCP: Ivanti Avalanche SmartDeviceServer DeviceLogsManager Directory Traversal
This signature detects attempts to exploit a known vulnerability against Ivanti Avalanche SmartDeviceServer DeviceLogsManager. A successful attack can lead to directory traversal and arbitrary code execution.
Extended Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DeviceLogResource class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15966.
Affected Products
Ivanti avalanche
Short Name
TCP:C2S:IVANTI-SER-DIR
Severity
Major
Recommended
False
Recommended Action
Drop
Category
TCP
Keywords
Avalanche CVE-2022-36981 DeviceLogsManager Directory Ivanti SmartDeviceServer Traversal
Release Date
08/04/2022
Supported Platforms
srx-branch-19.3
vsrx3bsd-19.2
srx-19.4
vsrx3bsd-19.4
srx-branch-19.4
vsrx-19.4
vsrx-19.2
srx-19.3
Sigpack Version
3588
Port
TCP/7225
False Positive
Unknown
Vendors
Ivanti