CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Description
CVE-2019-11510 is a critical-severity arbitrary file read vulnerability affecting Ivanti Pulse Connect Secure, a widely used SSL VPN solution. This path traversal flaw allows an unauthenticated remote attacker to send a specially crafted URI via HTTPS to read arbitrary files from the server, including sensitive configuration files and credentials. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it has been associated with ransomware campaigns. With an EPSS score of 94.46% (99.99th percentile), CVE-2019-11510 represents one of the most actively exploited vulnerabilities in the Pulse Connect Secure product line.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 8.2; 8.3; 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/108073(Broken Link, Third Party Advisory, VDB Entry)
- https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/(Broken Link, Third Party Advisory)
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/(Exploit, Third Party Advisory)
- https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf(Third Party Advisory)
- https://kb.pulsesecure.net/?atype=sa(Not Applicable, Vendor Advisory)
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/(Broken Link, Patch, Vendor Advisory)
- https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a%40%3Cuser.guacamole.apache.org%3E(Mailing List)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/927237(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11510(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal vulnerabilities occur when software uses external input to construct a pathname intended to identify a file or directory within a restricted parent directory, but fails to properly neutralize special elements that can resolve to a location outside of that directory. In the case of CVE-2019-11510, the Pulse Connect Secure web interface fails to adequately validate URI paths, allowing an attacker to traverse directory boundaries and read files anywhere on the system.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2019-11510 carries a maximum CVSS 3.1 score of 10.0 (CRITICAL), reflecting the most severe threat level possible. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker with network access. The scope is changed, meaning exploitation can affect resources beyond the vulnerable VPN appliance itself, as stolen credentials can be used to pivot into internal networks. Confidentiality (High): Attackers can read arbitrary files including cached plaintext credentials, session tokens, and VPN configuration data. Integrity (High): Stolen credentials enable unauthorized access to modify systems and data behind the VPN. Availability (High): Complete system compromise is possible through credential theft and lateral movement. The EPSS score of 94.46% indicates near-certain exploitation activity, and CISA has confirmed this vulnerability is actively used in ransomware operations.
Exploit Maturity
CVE-2019-11510 is one of the most heavily exploited VPN vulnerabilities in recent years. CISA has confirmed active exploitation through its KEV catalog listing, and the vulnerability is known to be used in ransomware campaigns. Public exploit code is available via Packet Storm Security, and additional exploit research has been published by DEVCORE. The EPSS score of 94.46% (99.99th percentile) indicates near-certain exploitation activity, placing this among the most exploited CVEs tracked. This vulnerability is frequently chained with CVE-2019-11539, a command injection flaw in the admin interface, to achieve full remote code execution on the VPN appliance. Federal agencies were required to remediate by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Reference CISA's Emergency Directive ED 21-03 for additional guidance on Pulse Connect Secure vulnerabilities.
- Upgrade all Ivanti Pulse Connect Secure instances to version 9.0R3.4 or later (for the 9.0 branch), 8.3R7.1 or later (for the 8.3 branch), or 8.2R12.1 or later (for the 8.2 branch) to fully address this vulnerability.
- After patching, immediately reset all user and administrative credentials, revoke and reissue all VPN session tokens and certificates, as these may have been compromised through the arbitrary file read prior to patching.
- Implement network-level access controls to restrict management interface access to trusted IP addresses only, and deploy intrusion detection rules to alert on path traversal patterns in Pulse Secure URIs.
- Conduct a thorough forensic investigation of all Pulse Connect Secure appliances, reviewing access logs for indicators of exploitation such as requests containing directory traversal sequences (e.g.,
/dana-na/../dana/html5acc/guacamole/), and check for unauthorized access to internal systems using stolen credentials.
Technical Details
CVE-2019-11510 is a path traversal vulnerability in the Pulse Connect Secure web server affecting versions 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. The vulnerability exists in the handling of URI paths, where specially crafted requests bypass the authentication check and directory restrictions, allowing unauthenticated access to arbitrary files on the appliance. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects the maximum exploitability: network-accessible, low complexity, no privileges or user interaction required, with changed scope indicating impact beyond the vulnerable component. Attackers typically target files such as /etc/passwd, session database files, and cached plaintext credentials stored on the appliance, enabling them to harvest valid VPN credentials and session cookies for unauthorized access to the protected network.
Frequently Asked Questions
Is CVE-2019-11510 being actively exploited?
Yes. CVE-2019-11510 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming widespread active exploitation. CISA has additionally confirmed that this vulnerability is used in ransomware campaigns. The EPSS score of 94.46% (99.99th percentile) indicates near-certain exploitation activity, making this one of the most exploited vulnerabilities tracked.
What products are affected by CVE-2019-11510?
CVE-2019-11510 affects Ivanti (formerly Pulse Secure) Pulse Connect Secure versions 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. All organizations using these VPN appliance versions are at risk of credential theft and network compromise.
How do I fix CVE-2019-11510?
Apply updates per vendor instructions to upgrade to patched versions (9.0R3.4, 8.3R7.1, or 8.2R12.1 and later). After patching, reset all user and admin passwords and revoke all active sessions, as credentials may have been stolen prior to patching.
How severe is CVE-2019-11510?
CVE-2019-11510 has a maximum CVSS 3.1 score of 10.0 (CRITICAL) and an EPSS score at the 99.99th percentile. This is a critical-severity vulnerability with confirmed ransomware usage that requires immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.