CVE-2019-11510: Proof of Concept Available for Arbitrary File Disclosure in Pulse Connect Secure

Scott Caveza

A proof of concept has been made public for CVE-2019-11510, an arbitrary file disclosure vulnerability found in popular virtual private network software, Pulse Connect Secure.

Background

On April 24, Pulse Secure released a security advisory (later amended to include CVEs on the 25th) and patch for multiple critical and high severity vulnerabilities. The issues were identified in Pulse Connect Secure (PCS), previously known as Juniper SSL Virtual Private Network (VPN), a widely used commercial VPN solution. The issues were found by Orange Tsai and Meh Chang from the DEVCORE research team who shared details on the subject at their Black Hat and DEF CON talks earlier this month in Las Vegas.

Among the most severe issues reported is CVE-2019-11510, an arbitrary file disclosure vulnerability. This flaw could allow an unauthenticated, remote attacker to read the contents of files found on a vulnerable device, including sensitive information such as configuration settings.

Analysis

In order to exploit the issue, an attacker can send a malicious HTTP request containing directory traversal sequences along with a crafted Uniform Resource Identifier (URI) and access any file on the device. This provides the attacker access to sensitive device information, and as the researchers describe in their initial report of the issue, this attack could be chained with other vulnerabilities they discovered.

When a user logs into the admin interface of the VPN, their plain-text password is stored in /data/runtime/mtmp/lmdb/dataa/data.mdb. Using the method described above, the attacker could obtain the file, extract the user’s password, and log into the device. Once logged in, the attacker can take advantage of CVE-2019-11539, a command injection vulnerability in the administrative web interface. Alternatively, with the user’s credentials in hand, the attacker could exploit CVE-2019-11508, a vulnerability in the Network File Share (NFS), which allows an authenticated user to upload a malicious file and write arbitrary files to the host.

This research demonstrates how an attacker can take advantage of a pre-authentication flaw and achieve command execution by chaining multiple vulnerabilities to compromise a vulnerable device. What is most concerning about these chained exploits is that PCS is used to restrict external access to an environment, and by achieving command execution on the device, an attacker could use this access to weaponize the device and use it for malicious purposes such as data exfiltration.

If the attacker is not able to find cached credentials, they can access the file /data/runtime/mtmp/system to gather a list of users and hashed passwords. With enough time, effort, and processing power, an attacker could crack the hashes, giving them the ability to log in with the stolen credentials.

Adding to the concern over the potential to exploit these flaws, a Shodan search lists more than 42,000 devices that may be affected if proper patches have not yet been applied.

Image source: https://www.shodan.io

A breakdown of the CVEs and the PCS versions affected are outlined below:

CVE CVSSv3 (Vendor Assigned) NVD CVSSv3 Score Tenable VPR Versions of Pulse Connect Secure Affected CVE-2019-11510 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 9.9 9.0RX, 8.3RX, 8.2RX Note: 8.1RX and below are not directly impacted CVE-2019-11508 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) 5.9 9.0RX, 8.3RX, 8.2RX, 8.1RX CVE-2019-11540 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 6.7 9.0RX, 8.3RX CVE-2019-11543 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 3 9.0RX, 8.3RX, 8.1RX CVE-2019-11541 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) 3.6 9.0RX, 8.3RX, 8.2RX CVE-2019-11542 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) 5.9 9.0RX, 8.3RX, 8.2RX, 8.1RX CVE-2019-11539 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) 8.4 9.0RX, 8.3RX, 8.2RX, 8.1RX CVE-2019-11538 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) 4.4 9.0RX 8.3RX 8.2RX 8.1RX CVE-2019-11509 6.4 (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 5.9 9.0RX 8.3RX 8.2RX 8.1RX CVE-2019-11507 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) 3 9.0RX 8.3RX

* Please note Tenable VPR scores are calculated nightly. This blog was updated on August 29 to reflect current VPR scores.

Proof of concept

A proof of concept (PoC) was published to the Exploit Database on August 20 as an exploit module written by Alyssa Herrera and Justin Wagner.

Solution

Pulse Secure has published a security advisory with information on each of the CVEs reported. Patching solutions are listed below:

Version installed Fixed release Pulse Connect Secure 9.0RX Pulse Connect Secure 9.0R3.4 & 9.0R4 Pulse Connect Secure 8.3RX Pulse Connect Secure 8.3R7.1 Pulse Connect Secure 8.2RX Pulse Connect Secure 8.2R12.1 Pulse Connect Secure 8.1RX Pulse Connect Secure 8.1R15.1

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities is listed here including a direct exploit check for CVE-2019-11510 (Plugin ID 127897).

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

Read more >

Published on Aug 21, 2019

People also viewed

Senior Financial Analyst - Corporate Development

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Finance Finance
Your Role:Become a core member of Tenable’s internal corporate development team and assist with business, financial and valuation modeling for mergers, acquisitions and other strategic investments and initiatives.  Assist with evaluating elements ...

Cloud Security Intern

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Information Technology Internships
Your Role: The Cloud Security Intern will help Tenable secure their use of cloud systems across the company.  The intern will develop, implement and monitor security solutions for the cloud that assess risk, keeps Tenable data safe and bake in sec...

Salesforce Administrator

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Business Platforms Business Platforms
Your Role:Tenable Network Security is looking for a Salesforce.com Administrator to join our internal business platforms team. The qualified candidate will engage in the administration of Tenable’s  Salesforce.com instance, play a key role in the ...

Technical Support Intern

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Internships
Your Role: The Technical Support Intern provides consistent, world-class security, network, and product support for specific Tenable products. In serving as the primary liaison between the company and customer, the Technical Support Intern resolve...

Research Intern - Plugin Automation

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Research Internships
Your Role: Tenable Research is looking for a Software Engineer Intern for the Plugin Automation team.  The position will involve developing frameworks for automated content creation, and processes for validating and publishing the content that is ...

Sales Development Manager

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Lead Generation Sales
Your Role:Tenable is looking for an experienced SDR Manager that will report to the Senior Director of Worldwide Sales Development and is responsible for ensuring the success of the Americas Tenable Sales Development team’s goals, as well as contr...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.