CVE-2019-11539
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
Description
CVE-2019-11539 is a high-severity command injection vulnerability affecting Ivanti Pulse Connect Secure and Pulse Policy Secure. The admin web interface of these SSL VPN products allows an authenticated attacker to inject and execute arbitrary operating system commands. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it has been associated with ransomware campaigns. With an EPSS score of 93.57% (99.83rd percentile), CVE-2019-11539 is among the most heavily targeted Pulse Secure vulnerabilities and is frequently chained with CVE-2019-11510 for unauthenticated remote code execution.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 8.1; 8.2; 8.3; 9.0 |
| ivanti | policy secure | 9.0 |
| pulsesecure | pulse policy secure | 5.1r1.0; 5.1r1.1; 5.1r2.0; 5.1r2.1; 5.1r3.0; 5.1r3.2; 5.1r4.0; 5.1r5.0; 5.1r6.0; 5.1r7.0; 5.1r8.0; 5.1r9.0; 5.1r9.1; 5.1r10.0; 5.1r11.0; 5.1r11.1; 5.1r12.0; 5.1r12.1; 5.1r13.0; 5.1r14.0; 5.2r1.0; 5.2r2.0; 5.2r3.0; 5.2r3.2; 5.2r4.0; 5.2r5.0; 5.2r6.0; 5.2r7.0; 5.2r7.1; 5.2r8.0; 5.2r9.0; 5.2r9.1; 5.2r10.0; 5.2r11.0; 5.2rx; 5.3r1.0; 5.3r1.1; 5.3r2.0; 5.3r3.0; 5.3r3.1; 5.3r4.0; 5.3r4.1; 5.3r5.0; 5.3r5.1; 5.3r5.2; 5.3r6.0; 5.3r7.0; 5.3r8.0; 5.3r8.1; 5.3r8.2; 5.3r9.0; 5.3r10.; 5.3r11.0; 5.3r12.0; 5.3rx; 5.4r1; 5.4r2; 5.4r2.1; 5.4r3; 5.4r4; 5.4r5; 5.4r5.2; 5.4r6; 5.4r6.1; 5.4r7; 5.4rx |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/108073(Broken Link, Third Party Advisory, VDB Entry)
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/(Exploit, Third Party Advisory)
- https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf(Exploit, Third Party Advisory)
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101(Third Party Advisory, Vendor Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/927237(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software constructs OS commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2019-11539, the Pulse Connect Secure and Pulse Policy Secure admin web interface fails to properly sanitize user-supplied input, enabling an authenticated administrator to inject shell commands that are executed by the underlying operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2019-11539 carries a CVSS 3.1 score of 7.2 (HIGH), indicating a significant threat to organizations running affected Pulse Secure products. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high privileges (administrative access) and no user interaction. Confidentiality (High): Successful command injection enables an attacker to read any file on the system and exfiltrate sensitive data including configuration files, credentials, and VPN session information. Integrity (High): Arbitrary command execution allows modification of system files, installation of backdoors, and tampering with VPN configurations. Availability (High): An attacker can disrupt VPN services, crash the appliance, or use it as a pivot point for further attacks on the internal network. The EPSS score of 93.57% indicates near-certain exploitation activity, and CISA has confirmed this vulnerability is used in ransomware operations. While administrative privileges are required, this vulnerability is commonly chained with CVE-2019-11510 to achieve unauthenticated exploitation.
Exploit Maturity
CVE-2019-11539 has well-established exploit maturity with multiple publicly available proof-of-concept exploits. CISA has confirmed active exploitation through its KEV catalog listing, and the vulnerability is known to be used in ransomware campaigns. Public exploit code is available via Packet Storm Security and additional exploit research has been published by DEVCORE. The EPSS score of 93.57% (99.83rd percentile) indicates near-certain exploitation. This vulnerability is a key component in attack chains: when combined with CVE-2019-11510 (an unauthenticated arbitrary file read), attackers first extract admin credentials and then use CVE-2019-11539 to execute arbitrary commands, achieving full remote code execution without any prior authentication.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Reference CISA's Emergency Directive ED 21-03 for additional guidance on mitigating Pulse Connect Secure product vulnerabilities.
- Upgrade Ivanti Pulse Connect Secure to version 9.0R3.4 or later, 8.3R7.1 or later, 8.2R12.1 or later, or 8.1R15.1 or later. For Pulse Policy Secure, upgrade to 9.0R3.2 or later, 5.4R7.1 or later, 5.3R12.1 or later, 5.2R12.1 or later, or 5.1R15.1 or later.
- Restrict administrative access to the web management interface to trusted IP addresses only, using firewall rules and network segmentation to limit exposure of the admin interface to the minimum necessary personnel.
- Implement robust input validation and web application firewall (WAF) rules to detect and block OS command injection patterns targeting the admin interface, and enable comprehensive logging of all administrative actions.
- Conduct a thorough security audit of all Pulse Secure appliances, reviewing admin access logs for suspicious command execution patterns, checking for unauthorized configuration changes, and verifying that no persistent backdoors have been installed.
Technical Details
CVE-2019-11539 is an OS command injection vulnerability in the admin web interface of Pulse Connect Secure versions 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, as well as Pulse Policy Secure versions 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1. The vulnerability exists because user-supplied input passed through the admin web interface is incorporated into OS commands without adequate sanitization of shell metacharacters. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low complexity, though high privileges are required. The scope is unchanged, meaning the impact is limited to the vulnerable component itself, but full compromise of the VPN appliance effectively grants access to the entire network behind it.
Frequently Asked Questions
Is CVE-2019-11539 being actively exploited?
Yes. CVE-2019-11539 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. CISA has also confirmed its use in ransomware campaigns. The EPSS score of 93.57% (99.83rd percentile) further underscores near-certain exploitation activity.
What products are affected by CVE-2019-11539?
CVE-2019-11539 affects Ivanti Pulse Connect Secure versions 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1. It also affects Pulse Policy Secure versions 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1.
How do I fix CVE-2019-11539?
Apply updates per vendor instructions to upgrade all affected Pulse Connect Secure and Pulse Policy Secure instances to the latest patched versions. Additionally, restrict admin web interface access to trusted networks and audit all appliances for signs of prior compromise.
How severe is CVE-2019-11539?
CVE-2019-11539 has a CVSS 3.1 score of 7.2 (HIGH) and an EPSS score at the 99.83rd percentile. While it requires administrative privileges, it is frequently chained with CVE-2019-11510 for unauthenticated exploitation, making it a critical remediation priority with confirmed ransomware usage.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.