CVE-2023-32560
CRITICALIvanti Avalanche < 6.4.1 - Remote Code Execution via Crafted Message
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2023-32560.
PoCs published by Robel Campbell, idkwastaken, x0rb3l, including Metasploit module exploits/windows/misc/ivanti_avalanche_mdm_bof.
AI-analyzed exploit summary This exploit targets Ivanti Avalanche <v6.4.0.0 via a crafted network message to achieve remote code execution. It leverages a stack-based buffer overflow with a ROP chain and embedded shellcode for a reverse TCP shell.
Description
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.
Exploits (4)
This exploit targets Ivanti Avalanche <v6.4.0.0 via a crafted network message to achieve remote code execution. It leverages a stack-based buffer overflow with a ROP chain and embedded shellcode for a reverse TCP shell.
This repository contains a functional exploit for CVE-2023-32560, targeting Ivanti Avalanche <v6.4.0.0. The exploit leverages a buffer overflow vulnerability to achieve remote code execution via a crafted network message with embedded shellcode.
This is a functional proof-of-concept exploit for CVE-2023-32560, targeting Ivanti Avalanche v6.4.0.0. It leverages a buffer overflow vulnerability to achieve remote code execution by sending a maliciously crafted packet to the target service on port 1777.
This Metasploit module exploits a buffer overflow in Ivanti Avalanche MDM (CVE-2023-32560) by sending a crafted packet to port 1777, leveraging a ROP chain to bypass DEP and achieve arbitrary code execution with SYSTEM privileges.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H