CVE-2021-22899
Ivanti Pulse Connect Secure Command Injection Vulnerability
Description
CVE-2021-22899 is a high-severity command injection vulnerability in Ivanti Pulse Connect Secure. The flaw exists in Pulse Connect Secure versions before 9.1R11.4, where a remote authenticated attacker can perform remote code execution by exploiting the Windows File Resource Profiles feature. CISA has added CVE-2021-22899 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild under Emergency Directive 21-03. With an EPSS score of 16.58% (94.8th percentile), this Ivanti Pulse Connect Secure command injection vulnerability represents a significant and actively targeted threat.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 9.0; 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22899(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Command injection vulnerabilities occur when software constructs system commands using externally influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2021-22899, the Windows File Resource Profiles feature in Pulse Connect Secure fails to properly sanitize user input, allowing an authenticated attacker to inject operating system commands that are executed by the underlying server.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
CVE-2021-22899 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting a severe security impact. The vulnerability is remotely exploitable over the network with low attack complexity, requiring only low-level privileges and no user interaction. Successful exploitation enables the attacker to execute arbitrary operating system commands on the Pulse Connect Secure appliance, resulting in complete compromise of confidentiality, integrity, and availability. An attacker could leverage command injection to extract sensitive VPN configuration data and credentials, install persistent backdoors, manipulate VPN routing, or use the compromised appliance as a pivot point for lateral movement into the internal network. The EPSS score of 16.58% (94.8th percentile) indicates a very high probability of exploitation, consistent with the confirmed active targeting of Pulse Connect Secure infrastructure by advanced threat actors.
Exploit Maturity
CVE-2021-22899 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with federal agencies required to remediate by 2022-05-03 under Emergency Directive 21-03. The EPSS score of 16.58% (94.8th percentile) indicates a high probability of exploitation activity. This vulnerability was disclosed alongside CVE-2021-22894 and CVE-2021-22900 as part of a coordinated advisory for Pulse Connect Secure in May 2021, and all three flaws were actively exploited by sophisticated threat actors targeting government and enterprise VPN infrastructure. The low authentication requirement (only low-level privileges needed) makes this command injection vulnerability particularly accessible to attackers.
Remediation
- Apply vendor patches immediately as required by CISA KEV directive: Apply updates per vendor instructions. Upgrade Ivanti Pulse Connect Secure to version 9.1R11.4 or later to fully address CVE-2021-22899.
- Verify that all instances of Ivanti Connect Secure versions 9.0 and 9.1 prior to 9.1R11.4 have been updated. Review the Windows File Resource Profiles configuration to ensure no unauthorized profiles have been created.
- If immediate patching is not possible, disable or restrict the Windows File Resource Profiles feature to minimize the attack surface until the update can be applied.
- Implement input validation and command sanitization at the network level using a web application firewall (WAF) to filter potentially malicious requests targeting the Windows Resource Profiles endpoint.
- Conduct a forensic review using the Pulse Connect Secure Integrity Checker Tool to identify indicators of compromise. Monitor system logs for unusual command execution patterns and reset all credentials that may have been exposed through the compromised appliance.
Technical Details
CVE-2021-22899 exploits a command injection weakness (CWE-77) in the Windows File Resource Profiles feature of Pulse Connect Secure versions before 9.1R11.4. The vulnerability occurs because user-supplied input passed through the Windows Resource Profiles interface is incorporated into system commands without proper neutralization of special characters or command separators. An authenticated attacker with low-level privileges can craft a malicious resource profile request that includes injected OS commands, which are then executed by the server with the privileges of the Pulse Connect Secure application process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-accessible, requires low complexity and only low privileges, with maximum impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-22899 being actively exploited?
Yes. CVE-2021-22899 is listed in the CISA Known Exploited Vulnerabilities catalog and is covered under Emergency Directive 21-03, confirming active exploitation by advanced threat actors. The EPSS score of 16.58% (94.8th percentile) further indicates a high probability of exploitation.
What products are affected by CVE-2021-22899?
CVE-2021-22899 affects Ivanti Pulse Connect Secure (formerly Pulse Secure) versions 9.0 and 9.1 prior to 9.1R11.4. The vulnerability specifically resides in the Windows File Resource Profiles feature.
How do I fix CVE-2021-22899?
Upgrade Ivanti Pulse Connect Secure to version 9.1R11.4 or later. As an interim mitigation, disable or restrict the Windows File Resource Profiles feature. Run the Pulse Connect Secure Integrity Checker Tool and reset all potentially exposed credentials.
How severe is CVE-2021-22899?
CVE-2021-22899 has a CVSS 3.1 score of 8.8 (HIGH). The command injection vulnerability requires only low-level authentication and enables remote code execution on the VPN appliance. The 94.8th EPSS percentile ranking and confirmed active exploitation make this a high-priority vulnerability requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.