CISA publishes malware analysis reports on samples targeting Pulse Secure devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-8260 | Authenticated RCE in Ivanti Pulse Connect Secure admin web interface (pre-9.1R9) Ivanti Pulse Connect Secure versions before 9.1R9 contain a vulnerability (mapped to CWE-434) in the administrative web interface in which compressed uploads are handled with uncontrolled gzip extraction. An authenticated attacker with high-privilege (admin-level) access to that interface can send a crafted gzip-compressed file, triggering arbitrary code execution on the appliance with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.2, AV:N/PR:H). Successful exploitation yields arbitrary code execution on the VPN appliance itself, effectively enabling full compromise of the gateway that terminates the organization's VPN sessions. Any organization running Pulse Connect Secure on a release prior to 9.1R9 is affected, making the typical target an enterprise or government SSL VPN appliance accessible to anyone holding admin credentials. Exploitation is in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a 96.5% EPSS exploitation probability (100th percentile), and a public proof of concept is available. Do: Upgrade Pulse Connect Secure to 9.1R9 or later per the vendor's instructions; given the related patch-bypass flaw CVE-2021-22937 and the 'new urgent update' headlines, ensure the most recent available 9.1R release is applied rather than relying solely on the original 9.1R9 fix. Restrict the admin web interface to trusted management networks and review administrative accounts. Because the flaw is on CISA's KEV list and CISA has published malware analysis reports for Pulse Secure-targeted samples, hunt patched and unpatched devices for signs of compromise (e.g., web shells or implants). | 7.2 | 96% | KEV PoC |
| mass≈10^5 devices: a six-figure installed base of Pulse Connect Secure appliances, with tens of thousands internet-exposed in public scans at the time of the 2021… | |
| CVE-2021-22893 | Use-After-Free RCE in Ivanti Pulse Connect Secure License Services Ivanti Pulse Connect Secure, a widely deployed SSL VPN appliance, contains a use-after-free vulnerability in its license services. A remote, unauthenticated attacker can trigger the flaw via the license services and gain arbitrary code execution on the appliance, which is a high-value target because it terminates VPN sessions for enterprise networks. Any organization running an affected Pulse Connect Secure release is potentially affected; the source data does not specify exact version ranges, so administrators should compare their release against Ivanti's advisory. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and its 47.2% EPSS score (99th percentile) indicates a high likelihood of exploitation within 30 days. Do: Apply the updates per Ivanti's instructions immediately, as CISA's required action specifies. Because exploited appliances have often retained persistent webshells/backdoors even after patching, also hunt for indicators of compromise (modified appliance files, unexpected processes or accounts) and follow Ivanti's remediation guidance rather than only installing the update. Until patched, restrict or closely monitor internet access to the appliance. | 10.0 | 47% | KEV ransomware |
| largetens of thousands of internet-exposed Pulse Connect Secure VPN appliances (order of magnitude ~10^4-10^5) | |
| CVE-2021-22937 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploa A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. NVD description · AI analysis pending | 7.2 | 8% |
| — |
Full article568 words · extracted from securityaffairs.com · click to collapse
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released five malware analysis reports (MARs) related to samples found on compromised Pulse Secure devices.
The U.S. CISA published five malware analysis reports (MARs) related to samples found on compromised Pulse Secure devices.
“As part of CISA’s ongoing response to Pulse Secure compromises, CISA has analyzed five malware samples related to exploited Pulse Secure devices. CISA encourages users and administrators to review the following five malware analysis reports (MARs) for threat actor tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs), and review CISA’s Alert, Exploitation of Pulse Connect Secure Vulnerabilities, for more information.” reads CISA’s advisory.
- MAR-10333243-3.v1: Pulse Connect Secure
- MAR-10334057-3.v1: Pulse Connect Secure
- MAR-10336935-2.v1: Pulse Connect Secure
- MAR-10338401-2.v1: Pulse Connect Secure
- MAR-10339606-1.v1: Pulse Connect Secure
The MARs include details on the tactics, techniques, and procedures (TTPs) employed by threat actors along with Indicators of Compromise (IOCs) for the attack.
Threat actors are targeting Pulse Connect Secure VPN devices exploiting multiple flaws, including CVE-2021-22893 and CVE-2021-22937.
CVE-2021-22893 is a buffer overflow issue in Pulse Connect Secure Collaboration Suite prior b9.1R11.4 that allows remote authenticated attackers to execute arbitrary code as the root user via maliciously crafted meeting room. According to coordinated reports published by FireEye and Pulse Secure in May, two hacking groups have exploited the zero-day vulnerability in Pulse Secure VPN equipment to break into the networks of US defense contractors and government organizations worldwide.
CVE-2021-22937 is a high-severity remote code execution vulnerability that resides in the admin web interface of Pulse Connect Secure. A remote attacker could exploit the flaw to overwrite arbitrary files and gain code execution with root privileges. The flaw received a CVSS score of 9.1, experts pointed out that it results from a bypass of the patch released in October 2021 to address the CVE-2020-8260 issue. Ivanti fixed this critical code execution issue in Pulse Connect Secure VPN early this month.
Two of the samples analyzed by CISA in the MARs are tainted Pulse Secure files retrieved from infected devices that were used to harvest credentials. Only one of them also implements backdoor capabilities, allowing threat actors to establish remote access to the compromised device.
Another file included a malicious shell script that could log a valid user’s username and password credentials into a file stored on disk. One of the reports provides details about a sample that involved multiple files, including a shell script used by attackers to modify a Pulse Secure file and use it as a webshell. Another sample documented by the experts allows attackers to parse incoming web request data, while another file could be used to intercept certificate-based multi-factor authentication.
“Some of the files consist of shell scripts designed to modify a Pulse Secure Perl Common Gateway Interface (CGI) script file in place to become a webshell. One file is designed to intercept certificate-based multi-factor authentication. The other files are designed to check, parse and decrypt incoming web request data. This analysis is derived from malicious files found on Pulse Connect Secure devices.” reads the MAR.
The fifth sample analyzed by the researchers includes two Perl scripts that allow attackers to execute commands, a Perl library, a Perl script, and a shell script that manipulate and execute the ‘/bin/umount’ file.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Pulse Secure)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121492/security/pulse-secure-cisa-mars.html