Pulse Connect Secure zero-day exploited pre-patch

6 May 2021 high vulnerability infrastructure

An actively exploited authentication-bypass and remote code execution flaw in Pulse Connect Secure VPN was disclosed before a vendor fix was available.

IPA issued an alert on a vulnerability in Pulse Connect Secure, a widely used enterprise VPN appliance, that allows a remote unauthenticated attacker to bypass authentication and execute arbitrary code. At the time of initial disclosure (April 21, 2021) no patched version existed, and the vendor recommended workarounds or temporarily disabling the product. Exploitation in the wild had already been confirmed globally, though no domestic (Japan) victims were reported at publication time.

The advisory affects Pulse Connect Secure 9.0R3 and later, and 9.1R1 and later, noting that other versions may also be impacted. On May 6, 2021, the vendor released patches covering all affected versions; IPA updated guidance to recommend applying the fix rather than relying solely on the interim mitigation, which involved importing an XML workaround file that disabled Windows File Share Browser and Pulse Secure Collaboration features to reduce URL-based attack exposure.

Given the product's role as an internet-facing remote access gateway, unpatched systems present a high-value target for initial access into enterprise networks. Organizations using Pulse Connect Secure should prioritize verifying patch status and reviewing logs for signs of prior exploitation during the vulnerable window.

Mentioned in this report

Vulnerabilities CVE-2021-22893KEV

Detection guidance

Pulse Connect Secure Arbitrary Code Execution Exploitation Attempt

ATT&CK T1190

Detects HTTP requests to Pulse Connect Secure endpoints known to be exploited in CVE-2021-22893, bypassing authentication to execute arbitrary commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Pulse Connect Secure Arbitrary Code Execution Exploitation Attempt
description: Detects exploitation attempts against Pulse Connect Secure (CVE-2021-22893)
  via suspicious HTTP requests to vulnerable endpoints that allow unauthenticated
  arbitrary code execution. Targets the distinctive URI patterns and methods used
  in exploitation chains.
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: proxy
  product: proxy
detection:
  selection_uri:
    cs-uri-stem|contains:
    - /dana-na/
    - /dana/home/
    cs-method:
    - POST
    - PUT
  selection_unauthenticated:
    cs-username: '-'
  selection_payload:
    cs-uri-query|contains:
    - user=
    - passwd=
    - cmd=
  filter_legitimate_auth:
    cs-uri-stem|contains: /login
  condition: (selection_uri and selection_unauthenticated and selection_payload) and
    not filter_legitimate_auth
falsepositives:
- Legitimate administrative access to Pulse Connect Secure login endpoints with query
  parameters
- Automated vulnerability scanning tools probing Pulse Connect Secure endpoints
level: high
id: 261b4f77-87ec-5f89-a77f-51dee1dc562f
status: experimental
author: Vorant

Suspicious Process Execution from Pulse Connect Secure Service

ATT&CK T1190

Detects arbitrary process spawning from Pulse Connect Secure application context, indicating successful exploitation and code execution on the appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Process Execution from Pulse Connect Secure Service
description: Detects process creation originating from Pulse Connect Secure application
  processes, indicating successful arbitrary code execution following exploitation
  of CVE-2021-22893. Focuses on child processes spawned by the Pulse service that
  are atypical for normal VPN gateway operations.
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - Pulse
    - PulseSecure
    - dsservice
  selection_suspicious_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    - \regsvcs.exe
    - \csc.exe
  filter_expected_parent:
    ParentImage|contains: PulseSecure_Installer
  condition: selection_parent and selection_suspicious_child and not filter_expected_parent
falsepositives:
- Pulse Connect Secure maintenance or diagnostic scripts spawning cmd.exe for system
  checks
- Legitimate IT automation tools that interact with the Pulse service
level: high
id: ef4dab33-877e-52d8-8037-934fc7541e05
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20210421.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free