Pulse Secure Connect Arbitrary File Read + Command Injection Chain
- Product
- Pulse Secure (Ivanti) Pulse Connect Secure
- CVE
- CVE-2019-11510CVE-2019-11539
- Disclosed
- 2019-04-24
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Pulse Connect Secure 9.0R1-9.0R3.3, 8.3R1-8.3R7, 8.2R1-8.2R12, 8.1R1-8.1R15.
- Fixed
- 9.0R3.4, 8.3R7.1, 8.2R12.1, 8.1R15.1.
Summary
Orange Tsai and Meh Chang showed that an unauthenticated arbitrary file read in Pulse Connect Secure could leak session data and cleartext credentials, which combined with an admin command injection gave full RCE. It was among the most widely exploited VPN bugs of 2019-2021, used by ransomware groups and APTs.
Root cause
CVE-2019-11510: URL handling for a specific web resource allowed path traversal outside the web root without authentication, exposing files like the session cache and cached user credentials. CVE-2019-11539: the admin web interface passed unsanitized input to a command line, enabling argument injection into a system binary.
Impact
Credential and session theft at scale and remote code execution on the VPN appliance.
Detection
Search access logs for '/dana-na/' requests containing '../'. Nuclei template CVE-2019-11510; version-check appliances.
Mitigation
Upgrade, then reset all user and admin credentials and invalidate sessions, since stolen data remains usable after patching.