CVE-2019-11510

What is Pulse Connect Secure?

Pulse Connect Secure (now owned by Ivanti, formerly Pulse Secure) is an SSL VPN appliance widely deployed by enterprises and government agencies to give remote users encrypted, authenticated access into internal corporate networks. As an internet-facing gateway that sits directly between the public internet and an organization's internal systems — and that stores credentials, session tokens, and configuration data — it is one of the highest-value targets in enterprise networking; compromising the appliance itself effectively hands an attacker the keys to the internal network.

Overview

CVE-2019-11510 is a pre-authentication arbitrary file read vulnerability in Pulse Connect Secure that lets a completely unauthenticated remote attacker retrieve arbitrary files from the appliance's filesystem via a specially crafted HTTPS URI. Because Pulse Connect Secure stores plaintext and hashed credentials, session cookies, and private keys on disk, this single flaw allows attackers to harvest active VPN session tokens and admin credentials, then replay them to gain full authenticated access to the internal network the VPN protects — without ever needing a valid account. It has been one of the most widely and persistently exploited vulnerabilities of the last several years, driving CISA to issue a dedicated Emergency Directive.

Affected Versions

Technical Details

The flaw (CWE-22, path traversal) lives in the appliance's web interface, where certain endpoints (notably under /dana-na/) fail to properly sanitize path segments before resolving files on disk. By crafting a URI that traverses out of the intended web-root directory — a pattern popularized as /dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/ — an unauthenticated attacker can read arbitrary files, including /data/runtime/mtmp/system (which contains cached usernames and plaintext passwords for currently logged-in users) and session-token stores. Reading these files converts the vulnerability directly into an authentication bypass: the attacker replays a stolen session cookie to access the VPN as a legitimate user without ever touching a password.

Discovery

The vulnerability was researched and disclosed by Orange Tsai and Meh Chang of DEVCORE as part of their "Attacking SSL VPN" research series examining enterprise VPN appliances, first patched by the vendor in April 2019 and detailed publicly at Black Hat USA and DEF CON in August 2019.

Exploitation Context

Mass scanning for unpatched Pulse Connect Secure appliances began within weeks of the Black Hat/DEF CON talks and has continued for years. This CVE has been used by numerous ransomware operators (including affiliates deploying REvil/Sodinokibi and other families) and by nation-state actors, including groups associated with China and Iran, to gain initial access to government and enterprise networks — most notably contributing to a wave of intrusions serious enough that CISA issued Emergency Directive 21-03 in April 2021 specifically requiring federal civilian agencies to patch or disconnect vulnerable appliances. The ransomwareUse: true flag reflects this sustained, confirmed use in ransomware intrusion chains.

Remediation

1. Upgrade to a patched Pulse Connect Secure release per the affected-versions table above immediately — this is not an optional hardening step given years of active mass exploitation.
2. Assume compromise if the appliance was ever internet-facing and unpatched: rotate all credentials, including local, AD-integrated, and service accounts that authenticated through the VPN, and invalidate all existing sessions.
3. Review appliance logs (and use Ivanti's provided integrity-checking tool) for indicators of prior exploitation, including unexpected file reads or unfamiliar session activity.
4. Enable multi-factor authentication for VPN access so that a stolen credential or session token alone is insufficient for access.
5. Follow CISA Emergency Directive 21-03 guidance even for non-federal networks: treat any historically internet-facing Pulse Connect Secure appliance as a potential prior breach point, not just a patching task.