cvelistv5 - cve-2021-22893

CVE-2021-22893 (GCVE-0-2021-22893)

Vulnerability from cvelistv5

Published

2021-04-23 16:29

Modified

2025-10-21 23:25

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication - Generic ()

Summary

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

References

URL

Tags

	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/	x_refsource_MISC
	https://blog.pulsesecure.net/pulse-connect-secure-security-update/	x_refsource_MISC
	https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html	x_refsource_MISC
	https://kb.cert.org/vuls/id/213092	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Pulse Connect Secure	Version: PCS 9.0R3 or above, PCS 9.1R1 and above

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2021-11-03

Due date: 2022-05-03

Required action: Apply updates per vendor instructions.

Used in ransomware: Known

Notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22893

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:58:24.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/213092"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.pulsesecure.net/pulse-connect-secure-security-update/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/213092"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-22893",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-23T21:35:28.790735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:48.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00.000Z",
            "value": "CVE-2021-22893 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pulse Connect Secure",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "PCS 9.0R3 or above, PCS 9.1R1 and above"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication - Generic (CWE-287)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-23T16:29:43.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.pulsesecure.net/pulse-connect-secure-security-update/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.cert.org/vuls/id/213092"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2021-22893",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Pulse Connect Secure",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PCS 9.0R3 or above, PCS 9.1R1 and above"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Authentication - Generic (CWE-287)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/",
              "refsource": "MISC",
              "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/"
            },
            {
              "name": "https://blog.pulsesecure.net/pulse-connect-secure-security-update/",
              "refsource": "MISC",
              "url": "https://blog.pulsesecure.net/pulse-connect-secure-security-update/"
            },
            {
              "name": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html",
              "refsource": "MISC",
              "url": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
            },
            {
              "name": "https://kb.cert.org/vuls/id/213092",
              "refsource": "MISC",
              "url": "https://kb.cert.org/vuls/id/213092"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2021-22893",
    "datePublished": "2021-04-23T16:29:43.000Z",
    "dateReserved": "2021-01-06T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:48.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2021-22893",
      "cwes": "[\"CWE-287\"]",
      "dateAdded": "2021-11-03",
      "dueDate": "2022-05-03",
      "knownRansomwareCampaignUse": "Known",
      "notes": "Reference CISA\u0027s ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22893",
      "product": "Pulse Connect Secure",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.",
      "vendorProject": "Ivanti",
      "vulnerabilityName": "Ivanti Pulse Connect Secure Use-After-Free Vulnerability"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.kb.cert.org/vuls/id/213092\"}, {\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://blog.pulsesecure.net/pulse-connect-secure-security-update/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://kb.cert.org/vuls/id/213092\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T18:58:24.775Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-22893\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-01-23T21:35:28.790735Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2021-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-11-03T00:00:00.000Z\", \"value\": \"CVE-2021-22893 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T19:11:54.890Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"Pulse Connect Secure\", \"versions\": [{\"status\": \"affected\", \"version\": \"PCS 9.0R3 or above, PCS 9.1R1 and above\"}]}], \"references\": [{\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://blog.pulsesecure.net/pulse-connect-secure-security-update/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://kb.cert.org/vuls/id/213092\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"Improper Authentication - Generic (CWE-287)\"}]}], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2021-04-23T16:29:43.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"PCS 9.0R3 or above, PCS 9.1R1 and above\"}]}, \"product_name\": \"Pulse Connect Secure\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/\", \"name\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/\", \"refsource\": \"MISC\"}, {\"url\": \"https://blog.pulsesecure.net/pulse-connect-secure-security-update/\", \"name\": \"https://blog.pulsesecure.net/pulse-connect-secure-security-update/\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\", \"name\": \"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\", \"refsource\": \"MISC\"}, {\"url\": \"https://kb.cert.org/vuls/id/213092\", \"name\": \"https://kb.cert.org/vuls/id/213092\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Improper Authentication - Generic (CWE-287)\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2021-22893\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"support@hackerone.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-22893\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:25:48.614Z\", \"dateReserved\": \"2021-01-06T00:00:00.000Z\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"datePublished\": \"2021-04-23T16:29:43.000Z\", \"assignerShortName\": \"hackerone\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2021-ALE-007

Vulnerability from certfr_alerte

[version du 3 mai 2021]

L'éditeur a publié le correctif pour la vulnérabilité CVE-2021-22893, ainsi que les vulnérabilités CVE-2021-22894, CVE-2021-22899 et CVE-2021-22900 avec un score CVSSv3 respectivement de 9.9, 9.9 et 7.2.

Si des mesures de contournement ont été appliquées, elles doivent être retirées en important le fichier remove-workaround-2104.xml, et les paramètres "Files, Windows" et "Meetings" doivent être restaurés avant l'application du correctif (cf. bulletin de sécurité de l'éditeur).

[version du 20 avril 2021]

Le 20 avril 2021, Pulse Secure a publié un bulletin de sécurité concernant la vulnérabilité CVE-2021-22893 (cf. section Documentation). Celle-ci permet à un attaquant non authentifié d'exécuter du code arbitraire à distance. Aucun correctif n'est pour l’instant disponible.

Le même jour, FireEye a publié un billet de blogue (cf. section Documentation) expliquant que cette vulnérabilité est activement exploitée dans le cadre d'attaques ciblées. Au cours d'une exploitation, les attaquants modifient certains fichiers pour déposer des portes dérobées et effacer leurs traces.

Pulse Secure a publié un outil qui tente de détecter ces modifications (cf. section Documentation).

Contournement provisoire

Dans l'attente de la publication du correctif (début mai selon FireEye), Pulse Secure a mis à disposition une mesure de contournement. La procédure est décrite dans son bulletin de sécurité.

Pulse Secure indique que sa mesure de contournement ne fonctionne pas pour les versions 9.0R1 à 9.0R4.1 et 9.1R1 à 9.1R2. Il convient alors de préalablement mettre l'équipement à jour vers une version compatible avec cette mesure de contournement.

Pour mettre en place la mesure de contournement, il faut télécharger et importer le fichier Workaround-2104.xml. Il faut également vérifier que le Windows File Browser est désactivé pour chaque utilisateur. La mesure de contournement repose sur une liste noire d'URLs considérées comme caractéristiques d'une attaque.

Pulse Secure précise que la mesure de contournement désactive Pulse Collaboration et peut affecter un éventuel répartiteur de charge s'il est placé devant l'équipement.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	N/A	N/A	Pulse Connect Secure versions 9.1RX
	N/A	N/A	Pulse Connect Secure versions 9.0R3 et ultérieures

References

Title

Publication Time

Tags

Billet de blogue FireEye du 20 avril 2021	-	other
Outil de vérification d'intégrité Pulse Secure	-	other
Bulletin de sécurité Pulse Secure SA44784 du 20 avril 2021	-	other
Avis CERT-FR CERTFR-2021-AVI-335 du 03 mai 2021	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Pulse Connect Secure versions 9.1RX",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Pulse Connect Secure versions 9.0R3 et ult\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2021-06-21",
  "content": "## Contournement provisoire\n\nDans l\u0027attente de la publication du correctif (d\u00e9but mai selon FireEye),\nPulse Secure a mis \u00e0 disposition une mesure de contournement. La\nproc\u00e9dure est d\u00e9crite dans son bulletin de s\u00e9curit\u00e9.\n\nPulse Secure indique que sa mesure de contournement ne fonctionne pas\npour les versions\u00a09.0R1 \u00e0 9.0R4.1 et 9.1R1 \u00e0 9.1R2. Il convient alors de\npr\u00e9alablement mettre l\u0027\u00e9quipement \u00e0 jour vers une version compatible\navec cette mesure de contournement.\n\nPour mettre en place la mesure de contournement, il faut t\u00e9l\u00e9charger et\nimporter le fichier\u00a0Workaround-2104.xml. Il faut \u00e9galement v\u00e9rifier que\nle Windows File Browser est d\u00e9sactiv\u00e9 pour chaque utilisateur. La mesure\nde contournement repose sur une liste noire d\u0027URLs consid\u00e9r\u00e9es comme\ncaract\u00e9ristiques d\u0027une attaque.\n\nPulse Secure pr\u00e9cise que la mesure de contournement d\u00e9sactive\u00a0Pulse\nCollaboration et peut affecter un \u00e9ventuel r\u00e9partiteur de charge s\u0027il\nest plac\u00e9 devant l\u0027\u00e9quipement.\n\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\u00a0\n",
  "cves": [
    {
      "name": "CVE-2021-22893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22893"
    },
    {
      "name": "CVE-2021-22894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22894"
    },
    {
      "name": "CVE-2021-22899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22899"
    },
    {
      "name": "CVE-2021-22900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22900"
    }
  ],
  "initial_release_date": "2021-04-20T00:00:00",
  "last_revision_date": "2021-06-21T00:00:00",
  "links": [
    {
      "title": "Billet de blogue FireEye du 20 avril 2021",
      "url": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
    },
    {
      "title": "Outil de v\u00e9rification d\u0027int\u00e9grit\u00e9 Pulse Secure",
      "url": "https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44755"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Pulse Secure SA44784 du 20 avril 2021",
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/"
    },
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-335 du 03 mai 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-335/"
    }
  ],
  "reference": "CERTFR-2021-ALE-007",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-20T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027avis CERT-FR CERTFR-2021-AVI-335 et disponibilit\u00e9 du correctif.",
      "revision_date": "2021-05-03T00:00:00.000000"
    },
    {
      "description": "correction du lien CERT-FR",
      "revision_date": "2021-05-03T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2021-06-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u003cstrong\u003e\\[version du 3 mai 2021\\]\u003c/strong\u003e\n\nL\u0027\u00e9diteur a publi\u00e9 le correctif pour la vuln\u00e9rabilit\u00e9 CVE-2021-22893,\nainsi que les vuln\u00e9rabilit\u00e9s CVE-2021-22894, CVE-2021-22899 et\nCVE-2021-22900 avec un score CVSSv3 respectivement de 9.9, 9.9 et 7.2.\n\nSi des mesures de contournement ont \u00e9t\u00e9 appliqu\u00e9es, elles doivent \u00eatre\nretir\u00e9es en important le fichier remove-workaround-2104.xml, et les\nparam\u00e8tres\u00a0\u003cspan id=\"j_id0:j_id1:j_id954\"\u003e\u003cspan\nid=\"j_id0:j_id1:j_id954:j_id955:j_id978\"\u003e\u003cspan\nid=\"j_id0:j_id1:j_id954:j_id955:j_id978:j_id979:j_id986\"\u003e\u003cspan\nid=\"j_id0:j_id1:j_id954:j_id955:j_id978:j_id979:j_id986:j_id987:j_id1230:j_id1232:3:j_id1233:j_id1234\"\u003e\"Files,\nWindows\" et \"Meetings\"\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e doivent \u00eatre\nrestaur\u00e9s avant l\u0027application du correctif (cf. bulletin de s\u00e9curit\u00e9 de\nl\u0027\u00e9diteur).\n\n\u003cstrong\u003e\\[version du 20 avril 2021\\]\u003c/strong\u003e\n\nLe 20 avril 2021, Pulse Secure a publi\u00e9 un bulletin de s\u00e9curit\u00e9\nconcernant la vuln\u00e9rabilit\u00e9\u00a0CVE-2021-22893 (cf. section Documentation).\nCelle-ci permet \u00e0 un attaquant non authentifi\u00e9 d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance. Aucun correctif n\u0027est pour l\u2019instant disponible.\n\nLe m\u00eame jour, FireEye a publi\u00e9 un billet de blogue\u00a0(cf. section\nDocumentation) expliquant que cette vuln\u00e9rabilit\u00e9 est activement\nexploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es. Au cours d\u0027une exploitation,\nles attaquants modifient certains fichiers pour d\u00e9poser des portes\nd\u00e9rob\u00e9es et effacer leurs traces.\n\nPulse Secure a publi\u00e9 un outil qui tente de d\u00e9tecter ces\nmodifications\u00a0(cf. section Documentation).\n\n\u00a0\n",
  "title": "[M\u00e0J] Vuln\u00e9rabilit\u00e9 dans Pulse Connect Secure",
  "vendor_advisories": []
}

CERTFR-2021-AVI-335

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Pulse Connect Secure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Pulse Connect Secure versions 9.0RX et 9.1RX antérieures à 9.1R11.4

Note : Si des mesures de contournement ont été appliquées, elles doivent être retirées en important le fichier remove-workaround-2104.xml, et les paramètres "Files, Windows" et "Meetings" doivent être restaurés avant l'application du correctif (cf. bulletin de sécurité de l'éditeur).

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Pulse Secure SA44784 du 20 avril 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003ePulse Connect Secure versions 9.0RX et 9.1RX ant\u00e9rieures \u00e0 9.1R11.4\u003c/li\u003e \u003c/ul\u003e \u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e : Si des mesures de contournement ont \u00e9t\u00e9 appliqu\u00e9es, elles doivent \u00eatre retir\u00e9es en important le fichier remove-workaround-2104.xml, et les param\u00e8tres\u00a0\u003cspan id=\"j_id0:j_id1:j_id954\"\u003e\u003cspan id=\"j_id0:j_id1:j_id954:j_id955:j_id978\"\u003e\u003cspan id=\"j_id0:j_id1:j_id954:j_id955:j_id978:j_id979:j_id986\"\u003e\u003cspan id=\"j_id0:j_id1:j_id954:j_id955:j_id978:j_id979:j_id986:j_id987:j_id1230:j_id1232:3:j_id1233:j_id1234\"\u003e\"Files, Windows\" et \"Meetings\"\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e doivent \u00eatre restaur\u00e9s avant l\u0027application du correctif (cf. bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur).\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22894"
    },
    {
      "name": "CVE-2021-22893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22893"
    },
    {
      "name": "CVE-2021-22900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22900"
    },
    {
      "name": "CVE-2021-22899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22899"
    }
  ],
  "initial_release_date": "2021-05-03T00:00:00",
  "last_revision_date": "2021-05-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-335",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-05-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Pulse Connect\nSecure. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance et un contournement de la politique de\ns\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Pulse Connect Secure",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Pulse Secure SA44784 du 20 avril 2021",
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2021-22893 (GCVE-0-2021-22893)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

CERTFR-2021-ALE-007

Vulnerability from certfr_alerte

Contournement provisoire

Solution

CERTFR-2021-AVI-335

Vulnerability from certfr_avis

Solution

Tags

Sightings

Nomenclature