CVE-2020-8218

What is Pulse Connect Secure?

Pulse Connect Secure (now part of Ivanti) is an enterprise SSL VPN gateway appliance used to give remote employees encrypted access into internal networks. This CVE is one of several authenticated admin-console code-execution bugs fixed in the product around this period — see also CVE-2020-8243 and CVE-2020-8260, also enriched on this site — all sharing the pattern of a privileged Pulse Secure administrator being able to escalate console access into full code execution on the appliance.

Overview

CVE-2020-8218 is a code injection vulnerability (CWE-94) in the Pulse Connect Secure admin web interface. An attacker who already holds administrative credentials can craft a URI that, when processed by the admin interface, results in arbitrary code execution on the appliance (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High).

Technical Details

The admin web interface fails to adequately sanitize certain URI components before processing them, allowing an authenticated administrator-level attacker to inject code that executes in the context of the appliance's admin service rather than being handled purely as request routing data.

Discovery

Fixed by Pulse Secure as part of its routine security advisory process for the Connect Secure product line.

Exploitation Context

CISA's Emergency Directive ED 21-03 covers this vulnerability alongside other Pulse Connect Secure CVEs, issued in response to sustained nation-state exploitation of the product line documented by Mandiant and others. As with the related Pulse Secure CVEs on this site, exploitation requiring existing administrative access means this bug is most valuable as a second-stage escalation tool for an attacker who has already compromised privileged credentials.

Remediation

1. Apply Pulse Secure/Ivanti's fix for Connect Secure covering this CVE immediately, per CISA ED 21-03 guidance.
2. Restrict and closely monitor administrative access to the appliance's management interface, including MFA and IP allowlisting for admin accounts.
3. Run CISA's Pulse Connect Secure Integrity Checker Tool to detect signs of prior compromise given this product line's extensive nation-state targeting history.
4. Treat this vulnerability alongside CVE-2020-8243 and CVE-2020-8260 as part of the same broader risk category — authenticated admin-to-RCE escalation — when prioritizing Pulse Connect Secure hardening work.