#VU27029 Path traversal


Published: 2020-04-20 | Updated: 2020-07-28

Vulnerability identifier: #VU27029

Vulnerability risk: Medium

CVSSv3: 6.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-11510

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: Yes
[Search exploit]

Vulnerable software: Pulse Connect Secure
Server applications / Remote access servers, VPN

Vendor: Pulse Secure

Description

The vulnerability allows a remote attacker to read arbitrary files on the system.

The vulnerability exists due to input validation error when processing HTTP requests in Pulse Connect Secure. A remote non-authenticated attacker can send a specially crafted HTTP request and read contents of arbitrary files on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Pulse Connect Secure: 8.2R1, 8.2R1.0, 8.2R1.1, 8.2R2.0, 8.2R3, 8.2R3.0, 8.2R3.1, 8.2R4, 8.2R4.0, 8.2R4.1, 8.2R5, 8.2R5.0, 8.2R5.1, 8.2R6, 8.2R6.0, 8.2R7.0, 8.2R7.1, 8.2R7.2, 8.2R8.0, 8.2R8.1, 8.2R8.2, 8.2R9.0, 8.2R10, 8.2R10.0, 8.2R11.0, 8.2R12.0, 8.3R1, 8.3R1.1, 8.3R2, 8.3R2.1, 8.3R3, 8.3R4, 8.3R5, 8.3R5.1, 8.3R5.2, 8.3R6, 8.3R6.1, 8.3R7, 9.0R1, 9.0R2, 9.0R2.1, 9.0R3, 9.0R3.1, 9.0R3.2

CPE

External links
http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html
http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html
http://www.securityfocus.com/bid/108073
https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
https://kb.pulsesecure.net/?atype=sa
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.


Latest bulletins with this vulnerability