CVE-2023-38036: Ivanti Avalanche Arbitrary Code Execution Vulnerability

CVE-2023-38036, a recently identified vulnerability in the Ivanti Avalanche system—a leading enterprise mobility management (EMM) solution revered for its prowess in managing, monitoring, and safeguarding a broad spectrum of mobile devices.

At its core, CVE-2023-38036 allows malevolent actors to send a deviously crafted message to the Wavelink Avalanche Manager. Upon receiving this message, the system could either crash—disrupting services—or worse, permit the execution of arbitrary codes. Notably, this flaw echoes the vulnerability identified as CVE-2023-32560 but stands apart in its mechanics. This perilous flaw permeates Ivanti Avalanche versions 6.4.0 and prior.

For those unfamiliar, CVE-2023-32560 (with a whopping CVSS v3 score of 9.8) is a chilling stack-based buffer overflow flaw. It’s a vulnerability that hackers can exploit remotely without requiring user authentication, granting them the ghastly ability to execute any code on the target system.

The term “buffer overflow” might sound arcane, but its implications are dire. In technical parlance, a buffer overflow occurs when a program, often unwittingly, writes excessive data into an adjacent memory block, or buffer. This “overflow” of data then spills into neighboring memory locations, leading to potential program crashes or enabling malicious entities to execute arbitrary codes.

In a shocking revelation in July, cybercriminals exploited a zero-day authentication bypass flaw (dubbed CVE-2023-35078) in Ivanti’s Endpoint Manager Mobile (EPMM). This breach wasn’t just a technical hiccup—it had geopolitical ramifications. The malefactors managed to penetrate a platform utilized by twelve Norwegian government ministries, gaining access to potentially classified and sensitive data.

A security researcher at Tenable deserves commendation for discovering and reporting CVE-2023-38036, underscoring the importance of collaborative efforts in combating cyber threats.

Ivanti has released a security advisory for this vulnerability and has provided a patch that can be applied to affected systems. Organizations that use Ivanti Avalanche should apply the patch as soon as possible to protect themselves from this vulnerability.