PT-2017-11813 · Pulse · Pulse Connect Secure

Published 2017-07-12 · Updated 2017-07-17 · CVE-2017-11194

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure version 8.3R1

Description The issue concerns a Reflected XSS in the adminservercacertdetails.cgi page of the admin panel. Specifically, the certid parameter of "adminservercacertdetails.cgi" is reflected in the application's response without proper sanitization, allowing an attacker to inject tags. This could enable an attacker to craft payloads that make the system execute commands such as ping, ping6, traceroute, nslookup, arp, etc.

Recommendations For Pulse Connect Secure version 8.3R1, as a temporary workaround, consider restricting access to the "adminservercacertdetails.cgi" page or sanitizing the certid parameter to prevent XSS attacks. Avoid using the certid parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-11194

Affected Products

Pulse Connect Secure

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-11194 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11194 · Vendor Advisory
• https://twitter.com/sxcurity/status/884556905145937921 · Note
• http://sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf · Note