CVE-2019-11510

CRITICAL9.9Path traversal

CISA KEVRansomwarePublic PoCTrendingHigh EPSS

Description

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

CVSS breakdown

CVSS 3.0

Attack Complexity

Low

Attack Vector

Network

Availability

High

Confidentiality

High

Integrity

High

Privileges Required

Low

Scope

Changed

User Interaction

None

Exploits & proofs of concept

nucleiPulse Connect Secure SSL VPN Arbitrary File Readby organiccrap

References

MISChttps://kb.pulsesecure.net/?atype=sa
VENDOR_ADVISORYhttps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/
MISChttp://www.securityfocus.com/bid/108073
VENDOR_ADVISORYhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
EXPLOIThttp://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html
MISChttps://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/
EXPLOIThttp://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html
MISChttps://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
MISChttps://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
MAILING_LISThttps://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a%40%3Cuser.guacamole.apache.org%3E
MISChttps://www.kb.cert.org/vuls/id/927237