HTTP: Pulse Connect Secure CVE-2021-22893 Remote Code Execution
This signature detects attempts to exploit a known vulnerability against Pulse Connect Secure. A successful attack can lead to arbitrary code execution.
Extended Description
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
Affected Products
Ivanti connect_secure
Short Name
HTTP:CTS:PULSE-CNCT-AUTHBYPS-CE
Severity
Critical
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2021-22893 CVE-2021-22908 Code Connect Execution Pulse Remote Secure
Release Date
05/10/2021
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3682
False Positive
Rarely
Vendors
Ivanti
CVSS Score
7.5
9.0