PT-2022-15159 · Pulse Secure · Pulse Secure

Published 2022-09-30 · Updated 2024-02-27 · CVE-2022-21826

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pulse Secure versions 9.115 and below

Description The issue allows for client-side HTTP request smuggling. When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection. As a result, when someone loads a website, an attacker may be able to make the browser issue a POST to the application, enabling Cross-Site Scripting (XSS).

Recommendations For Pulse Secure versions 9.115 and below, consider disabling the HTTP POST request handling until a patch is available. Restrict access to the application to minimize the risk of exploitation. Avoid using the application for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2022-21826

Affected Products

Pulse Secure

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-21826 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21826 · Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack · Vendor Advisory
• https://t.me/cibsecurity/50786 · Telegram Post