Pulse Connect Secure zero-day exploited pre-patch

A Pulse Connect Secure VPN flaw allowing authentication bypass and remote code execution was exploited in the wild before a vendor patch existed.

IPA Japan issued an alert on a vulnerability in Ivanti's Pulse Connect Secure VPN appliance that allows a remote, unauthenticated attacker to bypass authentication and execute arbitrary code. As of the initial April 21, 2021 disclosure, no fixed version was available from the vendor, and IPA recommended organizations apply the vendor's interim workaround or temporarily suspend use of the product. The alert notes that exploitation had already been observed in the wild, though no domestic (Japan) victims had been confirmed at the time of writing.

Affected versions include Pulse Connect Secure 9.0R3 and later, and 9.1R1 and later, with the vendor noting other versions may also be impacted. On May 6, 2021, the vendor released patches covering all affected versions, and IPA updated the advisory to recommend immediate patching. Prior to the patch, the recommended mitigation involved importing an XML-based workaround file that reduces URL-based attack impact by disabling the Windows File Share Browser and Pulse Secure Collaboration features, with organizations advised to verify Windows File Browser was properly disabled post-import.

This vulnerability was part of a broader wave of Pulse Connect Secure zero-day exploitation targeting VPN appliances used for remote access, a common target for espionage-motivated intrusion activity given their gateway position into enterprise networks.

title: Shell Spawned from Web Service Process on VPN/Gateway Appliance
id: 14487246-f5e9-5f84-946d-56112808b0e3
status: experimental
description: Detects an interactive shell or scripting interpreter (sh, bash, perl,
  python) spawned as a child of a web/application server or VPN appliance web service
  process. This pattern is consistent with successful exploitation of an unauthenticated
  remote code execution vulnerability in a public-facing appliance such as Pulse Connect
  Secure, where attackers leverage the web service to execute arbitrary commands prior
  to a vendor patch being available.
references:
- https://www.ivanti.com/blog/pulse-connect-secure
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /httpd
    - /nginx
    - /apache
    - dsserver
    - dspkginstall
    - /dana
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or health-check utilities that are invoked by
  the web service on some appliance configurations
- Vendor-provided maintenance or upgrade scripts that briefly spawn shells from the
  web service context
level: high
tags:
- attack.t1190
- attack.initial_access

title: Web-Executable File Written to Web-Accessible Directory by Web Service Process
id: 84d07afd-14c6-5e35-8c00-aa60afa2eea7
status: experimental
description: Detects a web server or VPN appliance service process writing a new script-type
  file (.jsp, .cgi, .pl, .php) into a directory that is typically served by the web
  application. This behaviour is consistent with webshell placement following successful
  exploitation of an unauthenticated remote code execution vulnerability in a public-facing
  appliance, as seen in pre-patch Pulse Connect Secure zero-day exploitation.
references:
- https://www.ivanti.com/blog/pulse-connect-secure
author: Vorant
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|contains:
    - /httpd
    - /nginx
    - /apache
    - dsserver
    - /dana
  selection_file:
    TargetFilename|endswith:
    - .jsp
    - .cgi
    - .pl
    - .php
  filter_known_updates:
    TargetFilename|contains:
    - /upgrade/
    - /patch/
  condition: selection_process and selection_file and not filter_known_updates
falsepositives:
- Legitimate vendor patch or upgrade processes that deploy new CGI/script files as
  part of an authorized update
- Administrator-deployed custom web pages or scripts through supported management
  interfaces
level: high
tags:
- attack.t1190
- attack.persistence

title: Outbound Network Connection Initiated by VPN Appliance Web Service Process
id: 3a097a0f-c94c-5e05-a1b3-c51acd3046db
status: experimental
description: Detects a process associated with the VPN appliance's web or authentication
  service initiating outbound network connections to external hosts. Web/authentication
  service processes on gateway appliances typically only receive inbound connections;
  outbound connections from these processes can indicate a reverse shell or command-and-control
  channel established after successful exploitation of an unauthenticated remote code
  execution vulnerability, as seen in pre-patch Pulse Connect Secure exploitation.
references:
- https://www.ivanti.com/blog/pulse-connect-secure
author: Vorant
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
    - /httpd
    - /nginx
    - /apache
    - dsserver
    - /dana
    Initiated: true
  filter_internal:
    DestinationIp|startswith:
    - '10.'
    - 172.16.
    - 192.168.
  condition: selection and not filter_internal
falsepositives:
- Legitimate license validation or update-check callbacks made by the appliance software
  to vendor infrastructure
- Monitoring or telemetry agents integrated into the web service that report to internal
  management servers
level: medium
tags:
- attack.t1190
- attack.command_and_control

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20210421.html