CVE-2019-11539
HIGH KEV RANSOMWAREPulse Secure <9.0R3.4-5.1R15.1 - Authenticated Command Injection
Title source: llmExploitation Summary
CVE-2019-11539 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 4 public exploits from researchers including Metasploit, Justin Wagner, 0xDezzy, including a Metasploit module exploits/linux/http/pulse_secure_cmd_exec.
AI-analyzed exploit summary This Metasploit module exploits a post-auth command injection vulnerability in Pulse Secure VPN (CVE-2019-11539) to execute arbitrary commands as root. It bypasses application whitelisting using the env(1) command and leverages a valid administrator session ID for authentication.
Description
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
Exploits (4)
This Metasploit module exploits a post-auth command injection vulnerability in Pulse Secure VPN (CVE-2019-11539) to execute arbitrary commands as root. It bypasses application whitelisting using the env(1) command and leverages a valid administrator session ID for authentication.
This exploit leverages CVE-2019-11539 to achieve post-authentication remote code execution on Pulse Secure VPN appliances. It injects commands via a tcpdump diagnostic tool to overwrite system files, enabling SSH access as root.
This repository contains a functional Python exploit for CVE-2019-11539, which targets an authenticated command injection vulnerability in Pulse Secure Pulse Connect Secure. The exploit logs in as an admin, injects commands via a tcpdump diagnostic feature, and overwrites SSH configuration files to enable root access.
This Metasploit module exploits a post-authentication command injection vulnerability in Pulse Secure VPN servers (CVE-2019-11539) by leveraging the env(1) command to bypass application whitelisting and execute arbitrary commands as root. It requires a valid administrator session ID and uses a CSRF token to craft malicious requests to the diagnostic CGI endpoint.
References (10)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H