Ivanti Pulse Connect Secure Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• Known to be used in ransomware campaigns
• EPSS: 47% chance of exploitation in the next 30 days (higher than 99% of CVEs)
• Critical severity: CVSS 10.0

[ Description ]Official description

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

CISA: Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blog.pulsesecure.net/pulse-connect-secure-security-updateVendor Advisory
• kb.cert.org/vuls/id/213092Third Party AdvisoryUS Government Resource
• kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784Broken LinkVendor Advisory
• www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techn…Third Party Advisory
• www.kb.cert.org/vuls/id/213092US Government Resource
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource