CVE-2021-42127 Deserialization in Ivanti Avalanche

Critical 9.8 Published 7 Dec 2021 Updated 4 Aug 2024

Attackers can execute arbitrary code via the Data Repository Service due to unsafe deserialization in Ivanti Avalanche.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-42127?

CVE-2021-42127 is a critical unsafe deserialization vulnerability in Ivanti Avalanche, published on 7 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.

Weakness: CWE-502

Which versions are affected by CVE-2021-42127?

It affects 1 product.

Products include Ivanti Avalanche.

How do I fix CVE-2021-42127?

No fix has been published for CVE-2021-42127 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-42127 being exploited?

There is no known exploitation of CVE-2021-42127 in the wild and no public exploit code.

All Ivanti Avalanche vulnerabilities

Sources

Also known as GHSA-5cxv-f998-83v8.