Ivanti fixed a critical code execution issue in Pulse Connect Secure VPN

Security firm Ivanti addressed a critical vulnerability in its Pulse Connect Secure VPN appliances that could be exploited to execute arbitrary code with root privileges.

IT firm Ivanti released security updates to address multiple vulnerabilities in its Pulse Connect Secure VPN appliances.

The most severe flaw, tracked as CVE-2021-22937 is a high-severity remote code execution vulnerability that resides in the admin web interface of Pulse Connect Secure.

A remote attacker could exploit the flaw to overwrite arbitrary files and gain code execution with root privileges. The flaw received a CVSS score of 9.1, experts pointed out that it results from a bypass of the patch released in October 2021 to address the CVE-2020-8260 issue.

“Successful exploitation of this issue results in Remote Code Execution on the underlying Operating System with root privileges. An attacker with such access will be able to circumvent any restrictions enforced via the web application, as well as remount the filesystem, allowing them to create a persistent backdoor, extract and decrypt credentials, compromise VPN clients, or pivot into the internal network.” reads the advisory published by NCC group.

The vulnerability CVE-2020-8260 resides in the admin web interface and an authenticated attacker could perform an arbitrary code execution using uncontrolled gzip extraction and write executable files in the /home/runtime/tmp/tt/ directory.

CVE-2021-22937, NCC Group’s researcher explains, isn’t the only variation of last year’s vulnerability discovered to date. In May 2021, Ivanti patched CVE-2020-22900, a bug that could allow for code execution by modifying the original exploit to specific CGI files.

Ivanti also addressed a critical vulnerability, tracked as CVE-2021-22935, that could be exploited for command injection “via an unsanitized web parameter.” The flaw received a CVSS score of 9.1.

The company fixed other four high-severity flaws that could allow an authenticated attacker to trigger a buffer overflow condition, conduct a cross-site scripting (XSS) attack or command injection, and arbitrary file delete.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, VPN)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.