#VU55617 Arbitrary file upload in Pulse Connect Secure


Published: 2021-08-05 | Updated: 2021-08-27

Vulnerability identifier: #VU55617

Vulnerability risk: Low

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-22937

CWE-ID: CWE-434

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Pulse Connect Secure
Server applications / Remote access servers, VPN

Vendor: Pulse Secure

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the administrative interface. A remote privileged user can upload a malicious archive and execute it on the server.

Note, the vulnerability is being actively exploited in the wild as of August 2021.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Pulse Connect Secure: 9.1R1 - 9.1R11.5


External links
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/p?pubstatus=o
http://us-cert.cisa.gov/ncas/current-activity/2021/08/24/cisa-releases-five-pulse-secure-related-mars


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.


Latest bulletins with this vulnerability