CVE-2021-22893

What it actually does

CVE-2021-22893 is an unauthenticated remote code execution vulnerability in Pulse Connect Secure gateways involving authentication bypass through the Windows File Share Browser and Pulse Secure Collaboration features. A remote attacker can reach vulnerable gateway functionality without valid credentials and trigger memory corruption/use-after-free behavior to execute arbitrary code in the context of the appliance. Because Pulse Connect Secure is an internet-facing VPN and remote-access gateway, successful exploitation can give an attacker direct control over the appliance, access to session material, credentials, configuration data, internal routing context, and a platform for persistence or lateral movement. The flaw has a CVSS score of 10.0, requires no authentication or user interaction, and is confirmed exploited in the wild.

Why it matters to the business

Compromise of a Pulse Connect Secure gateway can undermine the organization’s remote-access boundary: attackers may steal VPN credentials, hijack sessions, access internal resources, deploy webshells or backdoors, tamper with logs, and maintain covert access even after password resets. This vulnerability is listed in CISA KEV, has been used in ransomware campaigns, and had a CISA remediation deadline of 2022-05-03, so any remaining exposure should be treated as urgent and potentially already compromised. The provided affected-product metadata lists MediaWiki packages and fixed versions, which appears inconsistent with the Pulse Connect Secure vulnerability description; teams should validate asset inventory mappings and ensure Pulse/Ivanti gateways are remediated directly rather than assuming unrelated MediaWiki upgrades address this issue.

How an attack unfolds

An attacker scans the internet for exposed Pulse Connect Secure gateways and identifies versions running vulnerable 9.0R3/9.1R1 or later builds that have not received the vendor fix or mitigations. The attacker sends crafted unauthenticated requests to vulnerable Windows File Share Browser or Pulse Secure Collaboration endpoints, bypassing normal login checks and reaching code paths that can be abused for remote code execution. After gaining code execution on the gateway, the attacker commonly deploys a webshell or modifies appliance-side scripts to preserve access, harvests credentials/session artifacts, reviews configuration and internal network reachability, and may clean or alter logs to delay detection. In known intrusions, exploitation of Pulse Secure devices has been associated with persistent backdoors, credential theft, espionage activity, and ransomware-enabled access operations.

How to fix it

Prioritize remediation of all Pulse Connect Secure appliances. Upgrade affected Pulse Connect Secure versions to the vendor-fixed release for CVE-2021-22893, commonly referenced as PCS 9.1R11.4 or later, and follow current Ivanti/Pulse Secure advisories for any superseding versions or migration guidance. If immediate upgrade is not possible, apply the vendor XML workaround/mitigation that disables vulnerable Windows File Share Browser and Pulse Secure Collaboration functionality, but treat this only as temporary risk reduction. Run the vendor Pulse Secure Integrity Checker Tool or current Ivanti integrity tooling after patching, because patching alone does not remove attacker persistence. Rotate credentials, invalidate active VPN sessions, and review authentication integrations if compromise is suspected. The feed-provided fixed versions for MediaWiki are: Debian 11/12/13 mediawiki fixed in 1:1.35.0-1, wikimedia/mediawiki fixed in commit e34e7f20b51ed7514ba6de8d8a390363ade2237f, and mediawiki/core fixed in 1.34.3 or 1.35.0; however, those package versions do not remediate Pulse Connect Secure gateways and should be handled only if the organization separately tracks those MediaWiki issues.

How to confirm the fix worked

Confirm that no Pulse Connect Secure appliance is running an affected vulnerable build and that all appliances are upgraded to the vendor-fixed release or later. Verify that temporary mitigations, if used, are applied through the vendor-supported workaround mechanism and that vulnerable Windows File Share Browser and Pulse Secure Collaboration functionality is disabled until patching is complete. Run the Pulse Secure/Ivanti Integrity Checker Tool and compare results against a known-good baseline. Review appliance web server logs, admin logs, event logs, file integrity results, and backup/configuration diffs for unexpected modified scripts, unknown files, or unexplained administrative changes. Validate externally that the gateway no longer exposes vulnerable endpoints or behavior, and confirm that all active sessions were terminated and relevant credentials rotated after remediation.

Typical attack path

1. Identify internet-exposed Pulse Connect Secure gateways through scanning or existing reconnaissance data.
2. Fingerprint the gateway version and exposed features such as Windows File Share Browser or Pulse Secure Collaboration.
3. Send crafted unauthenticated requests to vulnerable Pulse Connect Secure endpoints to bypass authentication and trigger remote code execution.
4. Write or modify appliance-side files, scripts, or web-accessible components to establish persistence.
5. Collect VPN configuration, cached credentials, session tokens, user data, and internal network information from the appliance.
6. Use the compromised gateway as a trusted access point into internal systems or to support follow-on intrusion activity.
7. Attempt to hide activity by clearing, truncating, or tampering with Pulse Secure logs and appliance files.

How to detect it

Review Pulse Connect Secure appliance logs and any centralized syslog/SIEM copies for unauthenticated requests to Windows File Share Browser, collaboration, meeting, or HTML5 access endpoints followed by crashes, file changes, new web-accessible scripts, or unusual authenticated VPN activity. Inspect web server access logs for suspicious requests to /dana/fb/smb/, /dana-na/meeting/, /dana/html5acc/, and related CGI paths, especially from unknown internet IPs and especially where HTTP 200 responses are followed by administrative or internal access. Run Pulse Secure/Ivanti integrity-check tooling and investigate modified Perl modules, CGI scripts, template files, or unexpected files under webserver document paths. Look for signs of known Pulse Secure intrusion tooling and malware families publicly associated with these campaigns, including SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, and related webshell or log-cleaning activity. Correlate VPN login records after suspected exploitation with endpoint, identity, and network telemetry for anomalous source geographies, new devices, impossible travel, privileged account use, and unusual internal SMB/RDP/SSH access. Because attackers have been observed tampering with appliance logs, absence of logs should not be considered proof of no compromise; compare local logs with forwarded SIEM records and appliance backups.

• /dana/fb/smb/
• /dana/fb/smb/wnf.cgi
• /dana-na/meeting/
• /dana-na/meeting/meeting_testjs.cgi
• /dana/html5acc/
• /dana/html5acc/guacamole/
• GET /dana/fb/smb/wnf.cgi
• POST /dana/fb/smb/wnf.cgi
• GET /dana-na/meeting/meeting_testjs.cgi
• POST /dana-na/meeting/meeting_testjs.cgi
• GET /dana/html5acc/guacamole/
• POST /dana/html5acc/guacamole/
• SLOWPULSE
• RADIALPULSE
• THINBLOOD
• ATRIUM
• /home/webserver/htdocs/dana-na/meeting/meeting_testjs.cgi
• /home/webserver/htdocs/dana/fb/smb/wnf.cgi
• /home/webserver/htdocs/dana/html5acc/guacamole/
• /home/perl/DSUpgrade.pm
• /home/perl/DSSysConfig.pm
• /home/perl/DSLog.pm
• Integrity Checker Tool
• modified file detected
• unexpected file detected

What your security team should do

• Immediately inventory all Pulse Connect Secure/Ivanti Connect Secure gateways, including legacy, standby, disaster-recovery, and lab appliances exposed to the internet.
• Patch affected gateways to the vendor-fixed Pulse Connect Secure release or later; use vendor mitigations only as a short-term control.
• Because this is KEV-listed, exploited in the wild, and associated with ransomware activity, perform compromise assessment even if the device has now been patched.
• Run the vendor integrity checker and preserve appliance logs, configuration exports, and forensic artifacts before rebuilding or factory-resetting devices.
• Rotate VPN user credentials, administrator passwords, service-account secrets, SAML/OIDC/LDAP integration secrets, certificates, and invalidate active sessions where compromise cannot be ruled out.
• Hunt for suspicious access through Pulse Secure around the publication date and afterward, especially anomalous logins, impossible travel, unusual source IPs, and access to sensitive internal systems.
• Restrict administrative access to management interfaces, require MFA, and place VPN gateways behind appropriate monitoring and network controls where feasible.
• Validate asset and vulnerability-feed mappings because the supplied product/fix metadata includes MediaWiki packages that are inconsistent with this Pulse Connect Secure vulnerability.