^{CVE-2021-22893:}Authentication bypass vulnerability in Pulse Connect Secure allows unauthenticated remote code execution.

Overview

CVE-2021-22893 is a critical authentication bypass vulnerability in Pulse Connect Secure VPN appliances that allows unauthenticated remote code execution. The vulnerability affects the Windows File Share Browser and Pulse Secure Collaboration features in Pulse Connect Secure versions 9.0R3/9.1R1 and higher. This zero-day vulnerability has been actively exploited in the wild by suspected APT (Advanced Persistent Threat) actors to compromise networks. FireEye has documented exploitation attempts against defense, government, and financial organizations. The vulnerability allows attackers to bypass authentication controls and execute arbitrary code on the VPN appliance, potentially gaining complete control over the system and access to the internal network. As a Use After Free (CWE-416) vulnerability, it involves the incorrect use of memory after it has been freed, which can lead to the execution of arbitrary code.

Remediation

Organizations using affected Pulse Connect Secure versions should immediately:

1. Apply the security update provided by Pulse Secure to patch the vulnerability.
2. Follow the guidance in Pulse Secure Security Advisory SA44784.
3. Run the Pulse Connect Secure Integrity Tool to check for signs of compromise.
4. If compromise is detected, follow the incident response procedures outlined in the vendor advisory.
5. Consider implementing additional network segmentation to isolate VPN infrastructure.
6. Monitor for suspicious activity related to VPN access.
7. Implement multi-factor authentication if not already in use.
8. Review and update access control policies for VPN users.
9. Consider temporarily disabling the Windows File Share Browser and Pulse Secure Collaboration features until patching is complete.
10. Follow the specific mitigation guidance provided by US-CERT in VU#213092.

References

1. Pulse Secure Security Advisory: https://blog.pulsesecure.net/pulse-connect-secure-security-update/
2. US-CERT Vulnerability Note: https://kb.cert.org/vuls/id/213092
3. FireEye Threat Research: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
4. Pulse Secure Security Advisory SA44784 (Note: Link may be broken, check vendor website for updated information)
5. Common Weakness Enumeration: CWE-416 (Use After Free)