NCSC-TAD-2104-003
الرقم المرجعي: NCSC-TAD-2104-003CVSS 0
APT Actors Exploiting a Pulse Secure Flaw
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- CVE-2021-22893, CVE-2019-11510, CVE-2020-8243, CVE-2020-8260
نظرة عامة
Threat actors who may belong to APT5 are exploiting a zero-day flaw (CVE-2021-22893) in Pulse Connect Secure SSL VPN appliances. The vulnerability allows an unauthenticated attacker to execute arbitrary code remotely by sending a specially crafted HTTP request. The activity also involves previously known vulnerabilities that allow arbitrary file reading and code execution through custom template uploads and uncontrolled gzip extraction.
التقنيات المتأثرة
- Pulse Connect Secure SSL VPN appliances
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Pulse Secure advises customers with gateways running PCS 9.0R3 or higher to upgrade the server software to the 9.1R.11.4 release.
- 02
As a temporary workaround, the vulnerability can be mitigated on some gateways by disabling Windows File Share Browser and Pulse Secure Collaboration features by importing an XML file.
المراجع
- Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. (2021, April 20). Retrieved from FireEye(يفتح في علامة تبويب جديدة)
- CVE-2021-22893: Zero-Day Vulnerability in Pulse Connect Secure Exploited in the Wild. (2021, April 20). Retrieved from Tenable(يفتح في علامة تبويب جديدة)
- KB44755 - Pulse Connect Secure (PCS) Integrity Assurance. (2021, April 19). Retrieved from Public KB - KB44755 - Pulse Connect Secure (PCS) Integrity Assurance(يفتح في علامة تبويب جديدة)
- Spy groups hack into companies using zero-day flaw in Pulse Secure VPN. (2021, April 20). Retrieved from CSO Online(يفتح في علامة تبويب جديدة)
- WARNING: Hackers Exploit Unpatched Pulse Secure 0-Day to Breach Organizations. (2021, April 20). Retrieved from The Hacker News(يفتح في علامة تبويب جديدة)