Recent rash of ransomware attacks are leveraging an eight-month-old flaw in a popular SSL VPN solution used by large organizations and governments around the world.

CVE-2019-11510: Critical Pulse Connect Secure Vulnerability Used in Sodinokibi Ransomware Attacks

Attackers are exploiting arbitrary file disclosure vulnerabilities in popular SSL VPNs from Fortinet and PulseSecure.

CVE-2018-13379, CVE-2019-11510: FortiGate and Pulse Connect Secure Vulnerabilities Exploited In the Wild

A proof of concept has been made public for CVE-2019-11510, an arbitrary file disclosure vulnerability found in popular virtual private network software, Pulse Connect Secure.

CVE-2019-11510: Proof of Concept Available for Arbitrary File Disclosure in Pulse Connect Secure

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

The instance of Pulse Secure (formerly Juniper Networks JunOS Pulse) Pulse Connect Secure SSL VPN running on the remote host is affected by a path traversal vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to access arbitrary files on the remote host.

This can allow an attacker to obtain an authenticated HTTP session with the SSL VPN web application. The attacker could then leverage CVE-2019-11539, an authenticated command injecton vulnerability, to execute arbitrary commands on the SSL VPN.

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is affected by multiple vulnerabilities.

   - An arbitrary file read vulnerability exists in PCS. An      unauthenticated, remote attacker can exploit this, via specially      crafted URI, to read arbitrary files and disclose sensitive      information. (CVE-2019-11510)

   - Multiple vulnerabilities are found in Ghostscript.(CVE-2018-16513      , CVE-2018-18284, CVE-2018-15911, CVE-2018-15910, CVE-2018-15909)

   - A session hijacking vulnerability exists in PCS. An      unauthenticated, remote attacker can exploit this, to perform      actions in the user or administrator interface with the      privileges of another user. (CVE-2019-11540)

   - An authentication leaks seen in users using SAML authentication      with the reuse existing NC (Pulse) session option.
     (CVE-2019-11541)

   - Multiple vulnerabilities found in the admin web interface of PCS.
     (CVE-2019-11543, CVE-2019-11542, CVE-2019-11509, CVE-2019-11539)

   - Multiple vulnerabilities found in Network File Share (NFS) of PCS      , allows the attacker to read/write arbitrary files on the      affected device. (CVE-2019-11538, CVE-2019-11508)

   - A cross-site scripting (XSS) vulnerability exists in application      launcher page due to improper validation of user-supplied input      before returning it to users. An attacker can exploit this, by      convincing a user to click a specially crafted URL, to execute      arbitrary script code in a user's browser session.
     (CVE-2019-11507)

Refer to the vendor advisory for additional information.

ID	Name	Product	Family	Type	Severity
127897	Pulse Secure Pulse Connect Secure SSL VPN Unauthenticated Path Traversal (CVE-2019-11510)	Nessus	CGI abuses	Remote	critical
124766	Pulse Connect Secure Multiple Vulnerabilities (SA44101)	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2019-11510

critical

Tenable Plugins

critical

critical