PT-2020-6497 · Pulse · Pulse Connect Secure

Published 2020-10-26 · Updated 2021-11-03 · CVE-2020-8260

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions prior to 9.1R9

Description A vulnerability in the Pulse Connect Secure admin web interface could allow an authenticated attacker to perform arbitrary code execution using uncontrolled gzip extraction. This issue is related to the uncontrolled loading of files with a gzip extension, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For versions prior to 9.1R9, update to version 9.1R9 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin web interface to minimize the risk of exploitation. Avoid using the uncontrolled gzip extraction feature in the affected admin web interface until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-05469

CVE-2020-8260

Affected Products

Pulse Connect Secure

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_gzip_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html · Exploit
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8260 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8260 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05469 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8260 · Note
• https://t.me/cybersecuritytechnologies/1987 · Telegram Post
• https://t.me/thehackernews/1425 · Telegram Post
• https://t.me/true_secator/1675 · Telegram Post
• https://t.me/true_secator/1642 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note