PT-2020-12697 · Pulse Secure · Pulse Connect Secure

Giulio · Published 2020-04-06 · Updated 2021-09-16 · CVE-2020-11581

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pulse Secure Pulse Connect Secure (PCS) versions prior to 2020-04-06

Description The issue allows a man-in-the-middle attacker to perform OS command injection attacks against a client via shell metacharacters to the doCustomRemediateInstructions method. This is because Runtime.getRuntime().exec() is used. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, is vulnerable to this attack.

Recommendations For Pulse Secure Pulse Connect Secure (PCS) versions prior to 2020-04-06, as a temporary workaround, consider disabling the doCustomRemediateInstructions method until a patch is available. Restrict access to the tncc.jar applet to minimize the risk of exploitation. Avoid using shell metacharacters in the affected method to prevent OS command injection attacks.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-11581

Affected Products

Pulse Connect Secure

References · 6

• 🔥 https://git.lsd.cat/g/pulse-host-checker-rce · Exploit
• https://osv.dev/vulnerability/CVE-2020-11581 · Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11581 · Security Note
• https://t.me/cvenotify/2443 · Telegram Post
• https://t.me/cvenotify/2444 · Telegram Post