PT-2017-11812 · Pulse · Pulse Connect Secure

Published 2017-07-12 · Updated 2017-07-20 · CVE-2017-11193

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure version 8.3R1

Description The issue concerns a lack of protection against CSRF in the diag.cgi file, which is used for running various commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. This lack of protection can allow an attacker to run these commands against any IP address if they can trick an administrator into visiting a malicious page designed to exploit this weakness.

Recommendations For Pulse Connect Secure version 8.3R1, consider disabling access to the diag.cgi file until a patch is available to prevent potential exploitation. Restrict access to the administrative panel to minimize the risk of an attacker tricking an admin into visiting a malicious CSRF page.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-11193

Affected Products

Pulse Connect Secure

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-11193 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11193 · Vendor Advisory
• http://sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf · Note
• http://securityfocus.com/bid/99621 · Note
• https://twitter.com/sxcurity/status/884556905145937921 · Note