CVE-2020-8260
Ivanti Pulse Connect Secure Code Execution Vulnerability
Description
CVE-2020-8260 is a high-severity code execution vulnerability in Ivanti Pulse Connect Secure caused by unrestricted dangerous file upload. The flaw exists in the admin web interface of Pulse Connect Secure versions prior to 9.1R9, where an authenticated attacker can exploit uncontrolled gzip extraction to achieve arbitrary code execution on the underlying system. CISA has added CVE-2020-8260 to its Known Exploited Vulnerabilities catalog under Emergency Directive 21-03, confirming active exploitation in the wild. With an EPSS score of 77.71% (99.0th percentile), this Ivanti Pulse Connect Secure vulnerability is among the most likely to be exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | <= 9.0; 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8260(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerabilities occur when software allows the attacker to upload files of dangerous types that can be automatically processed by the server environment. In CVE-2020-8260, the Pulse Connect Secure admin web interface allows an authenticated attacker to upload a malicious gzip archive that is extracted without proper controls, leading to arbitrary file placement and code execution on the server.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2020-8260 carries a CVSS 3.1 score of 7.2 (HIGH), indicating a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high-level privileges (administrator access) and no user interaction. Successful exploitation leads to complete compromise of the confidentiality, integrity, and availability of the affected Pulse Connect Secure appliance through arbitrary code execution. An attacker with administrator access could use the uncontrolled gzip extraction to place malicious files on the system, install persistent backdoors, extract VPN credentials, or disrupt critical VPN services. The EPSS score of 77.71% (99.0th percentile) indicates an extremely high probability of exploitation, placing this vulnerability among the most actively targeted flaws in the Pulse Connect Secure product line.
Exploit Maturity
Public exploit code is available for CVE-2020-8260 via Packet Storm Security. The vulnerability is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with federal agencies required to remediate by 2022-05-03 under Emergency Directive 21-03. The EPSS score of 77.71% (99.0th percentile) indicates near-certain exploitation activity, making this one of the most aggressively targeted Pulse Connect Secure vulnerabilities. This flaw is commonly chained with other Pulse Connect Secure vulnerabilities such as CVE-2020-8243 and CVE-2021-22893 to achieve comprehensive VPN infrastructure compromise.
Remediation
- Apply vendor patches immediately as required by CISA KEV directive: Apply updates per vendor instructions. Upgrade Ivanti Pulse Connect Secure to version 9.1R9 or later to fully address CVE-2020-8260.
- Verify that all instances of Ivanti Connect Secure versions 9.0 and earlier, as well as version 9.1 prior to 9.1R9, have been updated. Both Connect Secure and Policy Secure appliances should be checked.
- Restrict access to the Pulse Connect Secure admin web interface to a dedicated management network and enforce IP-based allowlists to prevent exploitation by attackers with compromised administrator credentials.
- Run the Pulse Connect Secure Integrity Checker Tool to detect any unauthorized file modifications that may indicate prior exploitation via the uncontrolled gzip extraction mechanism. Look specifically for unexpected files in web-accessible directories.
- Implement strict upload validation controls where possible, and monitor for unusual gzip extraction events or file write activity on the appliance. Reset all administrator and user credentials that may have been exposed.
Technical Details
CVE-2020-8260 exploits an unrestricted dangerous file upload weakness (CWE-434) in the admin web interface of Pulse Connect Secure versions prior to 9.1R9. The vulnerability stems from the application's failure to properly validate and control gzip archive extraction during administrative file upload operations. When an authenticated administrator uploads a specially crafted gzip archive, the server extracts its contents without verifying the file types, paths, or destinations, enabling the attacker to write arbitrary files to the server's file system. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-accessible with low complexity but requires high privileges. The uncontrolled extraction can be leveraged to overwrite system configuration files or place executable scripts in locations that are processed by the server, ultimately achieving arbitrary code execution.
Frequently Asked Questions
Is CVE-2020-8260 being actively exploited?
Yes. CVE-2020-8260 is listed in the CISA Known Exploited Vulnerabilities catalog and is covered under Emergency Directive 21-03, confirming active exploitation. Public exploit code is available on Packet Storm Security. The EPSS score of 77.71% (99.0th percentile) indicates near-certain exploitation.
What products are affected by CVE-2020-8260?
CVE-2020-8260 affects Ivanti Pulse Connect Secure (formerly Pulse Secure) versions 9.0 and earlier, as well as version 9.1 prior to 9.1R9. The vulnerability is in the admin web interface's file upload and gzip extraction functionality.
How do I fix CVE-2020-8260?
Upgrade Ivanti Pulse Connect Secure to version 9.1R9 or later. Restrict admin interface access to dedicated management networks, run the Pulse Connect Secure Integrity Checker Tool to detect prior exploitation, and reset all credentials that may have been exposed.
How severe is CVE-2020-8260?
CVE-2020-8260 has a CVSS 3.1 score of 7.2 (HIGH). Despite requiring administrator authentication, the availability of public exploit code and the 99.0th EPSS percentile ranking make this vulnerability extremely dangerous. It enables arbitrary code execution on the VPN appliance through uncontrolled gzip extraction.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.