CVE-2024-47008: Ivanti Avalanche SSRF Vulnerability

CVE-2024-47008 Overview

CVE-2024-47008 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Ivanti Avalanche versions before 6.4.5. The flaw allows a remote, unauthenticated attacker to coerce the Avalanche server into issuing crafted HTTP requests on the attacker's behalf. Successful exploitation leaks sensitive information from internal services reachable by the Avalanche host.

Ivanti published a security advisory and remediated the issue in Avalanche 6.4.5. The vulnerability has an EPSS score of 46.385% (97.711 percentile), indicating elevated likelihood of exploitation activity relative to most published CVEs.

Critical Impact
Remote unauthenticated attackers can abuse the Avalanche server to query internal network resources and exfiltrate sensitive data from systems otherwise unreachable from the internet.

Affected Products

Ivanti Avalanche (Premise) versions prior to 6.4.5
Ivanti Avalanche on-premises mobile device management deployments
All Avalanche components reachable over the network prior to the 6.4.5 patch

Discovery Timeline

2024-10-08 - CVE-2024-47008 published to NVD
2024-10-16 - Last updated in NVD database

Technical Details for CVE-2024-47008

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. Ivanti Avalanche accepts attacker-controlled input that influences the destination of an outbound HTTP request issued by the server. Because the request originates from the Avalanche host, it bypasses perimeter controls and can target internal-only services.

The issue is reachable without authentication over the network, which removes any pre-exploitation barrier for an attacker who can route packets to the Avalanche management interface. The CWE-918 weakness pattern typically permits attackers to enumerate internal hosts, reach cloud metadata endpoints, and retrieve responses that contain configuration data, tokens, or credentials.

The scope of the leak is bounded to information confidentiality. Integrity and availability of the Avalanche server itself are not directly impacted by this issue, but follow-on attacks frequently leverage information harvested through SSRF to escalate access elsewhere.

Root Cause

The root cause is insufficient validation of a URL or host parameter that Avalanche uses when constructing server-side HTTP requests. Without strict allow-listing of permitted destinations or rejection of internal address ranges, the application honors arbitrary attacker-supplied targets.

Attack Vector

An unauthenticated attacker sends a crafted request to the vulnerable Avalanche endpoint with a URL pointing to an internal resource. The server fetches the resource and returns content or observable side effects to the attacker. Refer to the Ivanti Avalanche 6.4.5 Security Advisory for vendor-specific guidance.

No public proof-of-concept exploit is currently available for CVE-2024-47008, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-47008

Indicators of Compromise

Outbound HTTP requests from the Avalanche server to internal IP ranges (RFC1918), loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Unexpected DNS lookups initiated by the Avalanche host targeting attacker-controlled domains or internal hostnames.
Web access logs on the Avalanche server showing unauthenticated requests with URL parameters containing fully qualified host names or IP addresses.

Detection Strategies

Inspect Avalanche application logs for request parameters that include URL schemes (http://, https://, file://, gopher://) supplied by unauthenticated clients.
Correlate inbound requests to Avalanche with subsequent outbound connections originating from the same process to identify SSRF chains.
Monitor egress firewall logs for connections from the Avalanche server to destinations outside its documented operational baseline.

Monitoring Recommendations

Enable egress filtering and alert on Avalanche-originated traffic to internal management networks or cloud metadata services.
Forward Avalanche web server and application logs to a centralized SIEM with retention sufficient for retrospective hunting.
Track DNS query volume and destinations from the Avalanche host for anomalies indicative of SSRF probing.

How to Mitigate CVE-2024-47008

Immediate Actions Required

Upgrade Ivanti Avalanche to version 6.4.5 or later as specified in the Ivanti Security Advisory.
Restrict network access to the Avalanche management interface to trusted administrative networks only.
Audit Avalanche logs for evidence of SSRF probing prior to the patch being applied.

Patch Information

Ivanti has addressed CVE-2024-47008 in Avalanche 6.4.5. Administrators should apply the update through standard Ivanti patching procedures and validate the running version after upgrade. Consult the vendor advisory for full remediation steps and any prerequisite updates.

Workarounds

Place the Avalanche server behind an egress proxy that blocks requests to internal IP ranges and cloud metadata endpoints until the patch is applied.
Apply host-based firewall rules on the Avalanche server denying outbound connections to 127.0.0.0/8, 169.254.0.0/16, and other sensitive ranges not required for operation.
Limit inbound access to the Avalanche service to authenticated VPN users where business requirements permit.

bash

# Example iptables egress restriction for the Avalanche host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP