CVE-2021-22900
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
Description
CVE-2021-22900 is a high-severity unrestricted file upload vulnerability in Ivanti Pulse Connect Secure. The flaw exists in Pulse Connect Secure versions before 9.1R11.4, where an authenticated administrator can exploit the admin web interface to perform a file write by uploading a maliciously crafted archive. CISA has added CVE-2021-22900 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild and referencing Emergency Directive 21-03. With an EPSS score of 0.81% (74.1st percentile), exploitation of this Ivanti Pulse Connect Secure vulnerability is a realistic concern for organizations using affected versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 9.0; 9.1 |
| pulsesecure | pulse connect secure | <= 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22900(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection vulnerabilities occur when an application incorporates untrusted input into code that is subsequently executed. In CVE-2021-22900, the Pulse Connect Secure admin interface fails to properly validate archive uploads, enabling an authenticated administrator to upload a malicious archive that leads to arbitrary file writes and potential code execution.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
CWE-669: Incorrect Resource Transfer Between Spheres
Incorrect resource transfer between spheres occurs when a product does not properly transfer resources between controlled and uncontrolled domains. In CVE-2021-22900, the archive upload mechanism transfers file content from the user-controlled upload into the server's file system without adequate boundary enforcement, allowing files to be written to unauthorized locations.
Learn more: CWE-669 — Incorrect Resource Transfer Between Spheres
Impact Analysis
CVE-2021-22900 carries a CVSS 3.1 score of 7.2 (HIGH), indicating a significant security risk. The vulnerability is exploitable over the network with low attack complexity, though it requires high-level privileges (administrator access) and no user interaction is needed. Successful exploitation allows an attacker to write arbitrary files on the Pulse Connect Secure appliance, which can lead to full compromise of the system's confidentiality, integrity, and availability. An attacker with admin credentials could overwrite critical system files, deploy backdoors, or disrupt VPN services. The EPSS score of 0.81% (74.1st percentile) indicates a moderate but real probability of exploitation, particularly given the confirmed active exploitation by threat actors targeting Pulse Connect Secure infrastructure.
Exploit Maturity
CVE-2021-22900 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Federal agencies were required to remediate by 2022-05-03 per CISA Emergency Directive 21-03. The EPSS score of 0.81% (74.1st percentile) indicates a moderate probability of exploitation. While no public proof-of-concept exploit is specifically tagged in the NVD references, this vulnerability is part of a cluster of Pulse Connect Secure flaws disclosed in 2021 that were actively exploited by state-sponsored threat actors, making timely remediation essential.
Remediation
- Apply vendor patches immediately as required by CISA KEV directive: Apply updates per vendor instructions. Upgrade Ivanti Pulse Connect Secure to version 9.1R11.4 or later to fully address CVE-2021-22900.
- Verify that all instances of affected products — Ivanti Connect Secure versions 9.0 and 9.1 prior to 9.1R11.4, as well as legacy Pulse Connect Secure versions up to and including 9.1 — have been updated to patched versions.
- Restrict access to the Pulse Connect Secure admin web interface to a dedicated management VLAN or specific trusted IP addresses, preventing exploitation by attackers who may have compromised administrator credentials.
- Audit administrator accounts for unauthorized access and review upload activity logs within the admin interface for any suspicious archive uploads that may indicate prior exploitation attempts.
- Deploy file integrity monitoring on the Pulse Connect Secure appliance to detect unauthorized file modifications and run the Pulse Connect Secure Integrity Checker Tool to validate system integrity.
Technical Details
CVE-2021-22900 exploits a combination of code injection (CWE-94) and incorrect resource transfer (CWE-669) weaknesses in the admin web interface of Pulse Connect Secure versions before 9.1R11.4. The vulnerability allows an authenticated administrator to upload a maliciously crafted archive file through the admin interface, which is then extracted by the server without adequate validation of file paths or content. This uncontrolled extraction enables arbitrary file writes to the server's file system, potentially overwriting critical configuration files or placing executable code in accessible locations. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms network-based exploitability with low complexity, though high privileges are required. The combination of unrestricted file upload with improper resource boundary enforcement makes this a potent post-authentication attack vector.
Frequently Asked Questions
Is CVE-2021-22900 being actively exploited?
Yes. CVE-2021-22900 is listed in the CISA Known Exploited Vulnerabilities catalog and falls under Emergency Directive 21-03, confirming active exploitation. The EPSS score of 0.81% (74.1st percentile) indicates a moderate probability of exploitation.
What products are affected by CVE-2021-22900?
CVE-2021-22900 affects Ivanti Connect Secure versions 9.0 and 9.1 prior to 9.1R11.4. Legacy Pulse Connect Secure versions up to and including 9.1 (before the Ivanti rebrand) are also affected.
How do I fix CVE-2021-22900?
Upgrade Ivanti Pulse Connect Secure to version 9.1R11.4 or later. Restrict admin interface access to trusted networks, audit administrator accounts, and use the Pulse Connect Secure Integrity Checker Tool to verify system integrity.
How severe is CVE-2021-22900?
CVE-2021-22900 has a CVSS 3.1 score of 7.2 (HIGH). Although administrator-level authentication is required, successful exploitation allows arbitrary file writes that can fully compromise the VPN appliance. Its presence in the CISA KEV catalog confirms real-world exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.