CVE-2020-8243

What is Pulse Connect Secure?

Pulse Connect Secure (now part of Ivanti) is an enterprise SSL VPN gateway appliance used to give remote employees encrypted access into internal networks. As one of the most-targeted perimeter device product lines of the early 2020s — see also CVE-2020-8260 and CVE-2020-8218, also enriched on this site — its administrative interface has repeatedly been a source of authenticated, post-login RCE vulnerabilities.

Overview

CVE-2020-8243 is a code execution vulnerability (CWE-94) in the Pulse Connect Secure admin web interface. An attacker who already holds administrative credentials can upload a custom template that, when processed by the appliance, executes arbitrary code (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) — a post-authentication bug, meaningfully different in risk profile from Pulse Secure's more infamous pre-auth CVEs like CVE-2019-11510.

Technical Details

The vulnerability allows an authenticated administrator-level user to upload a custom template file to the appliance without adequate validation of its contents; because the template is subsequently processed and rendered by the server, an attacker can embed executable code in the template rather than purely presentational content, achieving code execution on the appliance itself.

Discovery

Fixed by Pulse Secure (now Ivanti) as part of its routine security advisory process.

Exploitation Context

CISA's Emergency Directive ED 21-03, issued in April 2021, covers this vulnerability alongside other Pulse Connect Secure CVEs in response to active nation-state exploitation of the product line. Because exploitation requires existing administrative credentials, this CVE is typically valuable as a second-stage tool for an attacker who has already gained privileged access through another vector, rather than as an initial-access vulnerability.

Remediation

1. Apply Ivanti's fix for Pulse Connect Secure covering this CVE immediately, per CISA ED 21-03 guidance.
2. Restrict and closely monitor administrative access to the Pulse Connect Secure management interface, including MFA and IP allowlisting for admin accounts.
3. Run CISA's Pulse Connect Secure Integrity Checker Tool to detect signs of prior compromise, given this product line's history of nation-state targeting.
4. Audit which administrator accounts have used the custom template upload feature, and treat any unexpected template modifications as a potential compromise indicator.