Path traversal in Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2019-11510
Published: April 20, 2020 / Updated: February 23, 2024
Vulnerability identifier: #VU27029
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11510
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to read arbitrary files on the system.
The vulnerability exists due to input validation error when processing HTTP requests in Pulse Connect Secure. A remote non-authenticated attacker can send a specially crafted HTTP request and read contents of arbitrary files on the system.
Affected software
Ivanti Connect Secure (formerly Pulse Connect Secure)
How to mitigate CVE-2019-11510
Install update from vendor's website.
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 8.2R12.1, 8.3R7.1, 9.0R3.4
Links to Public Exploits and PoC-codes
- Exploit #9560 - -CVE-2019-11510-Exploit () (February 23, 2024)
- Exploit #5902 - Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Arbitrary File Disclosure (Metasploit) (June 17, 2021)
- Exploit #3603 - pulse-exploit (Pulse Secure SSL VPN exploit (CVE-2019-11510) using hosts retrieved from Shodan API.) (July 28, 2020)
- Exploit #2600 - pulsexploit (Automated script for Pulse Secure SSL VPN exploit (CVE-2019-11510) using hosts retrieved from Shodan API. You must have a Shodan account to use this script.) (April 26, 2020)
- Exploit #2594 - CVE-2019-11510 (Exploit for Arbitrary File Read on Pulse Secure SSL VPN (CVE-2019-11510)) (April 22, 2020)
- Exploit #2593 - pwn-pulse (Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability (CVE-2019-11510)) (April 22, 2020)
External References
- http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html
- http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html
- http://www.securityfocus.com/bid/108073
- https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
- https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
- https://kb.pulsesecure.net/?atype=sa
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
- https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010