Pulse Secure SSL VPN Vulnerabilities Alert

Researcher detected multiple vulnerabilities in the Pulse Secure SSL VPN. These vulnerabilities can exploit the vulnerability to read arbitrary files including plaintext passwords, account information, and session information, as well as execute system commands.

Vulnerability detail

• CVE-2019-11510 – Pre-auth Arbitrary File Reading
• CVE-2019-11542 – Post-auth Stack Buffer Overflow
• CVE-2019-11539 – Post-auth Command Injection
• CVE-2019-11538 – Post-auth Arbitrary File Reading
• CVE-2019-11508 – Post-auth Arbitrary File Writing
• CVE-2019-11540 – Post-auth Session Hijacking

CVE-2019-11510: Read any system files without authorization.

/etc/passwd
/etc/hosts
/data/runtime/mtmp/system
/data/runtime/mtmp/lmdb/dataa/data.mdb
/data/runtime/mtmp/lmdb/dataa/lock.mdb
/data/runtime/mtmp/lmdb/randomVal/data.mdb
/data/runtime/mtmp/lmdb/randomVal/lock.mdb

The VPN user and hashed passwords are stored in the file mtmp/system. However, Pulse Secure caches the plain-text password in the dataa/data.mdb once the user log-in. Here, we just grep part of username/plain-text-password for proofs and further actions.

CVE-2019-11539: the command injection vulnerability can be combined with this hole to execute system commands.

Affected version

Solution

• Pulse Connect Secure and Pulse Policy Secure 9.1R1 and above
• All patched versions stated in the Solution Section