CVE-2021-22894

What it actually does

This vulnerability is a remotely reachable buffer overflow in the Pulse Connect Secure / Ivanti Connect Secure collaboration or meeting-room functionality prior to version 9.1R11.4. An authenticated attacker with network access to the VPN appliance can submit a maliciously crafted meeting-room request that corrupts memory and causes execution of attacker-controlled code with root privileges on the appliance. Successful exploitation gives the attacker full control of the VPN gateway, including the ability to modify system files, deploy web shells or backdoors, steal credentials and session material, inspect VPN traffic, and pivot into internal networks reachable through the appliance.

Why it matters to the business

Because the affected product is an internet-facing remote-access VPN, compromise can expose remote-access credentials, active sessions, internal network paths, and sensitive traffic that transits the gateway. The vulnerability is listed in CISA KEV with active in-the-wild exploitation and a remediation deadline of 2022-05-03, so unpatched systems should be treated as high-risk legacy exposure even though the issue is older. Operational consequences can include unauthorized network access, persistence on the VPN appliance, interruption of remote-access services, incident response costs, and potential regulatory or contractual reporting obligations if credentials or internal data were accessed.

How an attack unfolds

An attacker first obtains valid low-privilege access to the VPN portal, commonly through stolen credentials, password reuse, phishing, credential stuffing, or compromise of a legitimate account. After authenticating, the attacker reaches the collaboration or meeting-room feature and submits a specially crafted meeting-room value that triggers a buffer overflow in the vulnerable Pulse Connect Secure code path. The malformed request overwrites process memory and redirects execution to attacker-controlled instructions. Because the vulnerable service runs with high privileges, successful exploitation results in root-level code execution on the appliance. From there, the attacker can deploy persistence, alter appliance files, harvest credentials and session cookies, tamper with logs, create additional access paths, and use the trusted VPN position to access internal systems. Public reporting and KEV status indicate this class of Pulse Connect Secure vulnerabilities has been actively exploited in the wild, so exposed legacy appliances should be investigated for compromise rather than only patched.

How to fix it

Upgrade affected Pulse Connect Secure / Ivanti Connect Secure appliances to 9.1R11.4 or later; if a more recent vendor-supported release is available, upgrade to the latest fixed and supported version rather than only the minimum fixed release. If immediate upgrade is not possible, restrict access to the VPN portal to trusted source networks, disable or limit collaboration/meeting-room functionality where feasible, enforce MFA, review and reduce user privileges, and monitor the appliance closely; however, compensating controls should be considered temporary because successful exploitation results in root-level compromise. For any appliance that was exposed while vulnerable, run the vendor integrity checking tooling, review for unauthorized file changes or persistence, rotate administrative and user credentials, revoke active sessions, and consider rebuilding or replacing the appliance if compromise cannot be confidently ruled out.

How to confirm the fix worked

Confirm the appliance version from the administrative interface or vendor-supported command-line/status mechanism and verify it is 9.1R11.4 or later, preferably the latest supported release. Validate that all nodes in clustered or high-availability deployments have been upgraded, not only the active node. Confirm that collaboration/meeting-room functionality is disabled or access-controlled if it is not required. Run the vendor Integrity Checker Tool or current vendor-recommended appliance integrity validation and verify there are no unexpected modifications to system files, web-accessible scripts, or appliance configuration. Perform an external attack-surface scan to ensure no legacy Pulse Connect Secure instance remains exposed. Review authentication, web, admin, and system logs around the period before patching for suspicious meeting-room access, abnormal crashes, unexpected root-level commands, and unauthorized file writes.

Typical attack path

1. Identify an internet-facing Pulse Connect Secure / Ivanti Connect Secure appliance running a vulnerable pre-9.1R11.4 release.
2. Acquire valid VPN portal credentials or an authenticated session through phishing, credential theft, reuse, or another access path.
3. Log in to the VPN appliance as an authenticated user.
4. Access the collaboration or meeting-room functionality exposed by the vulnerable appliance.
5. Submit a maliciously crafted meeting-room request designed to trigger the buffer overflow.
6. Gain arbitrary code execution as root on the VPN appliance.
7. Install persistence, web shells, modified scripts, or additional backdoors on the appliance.
8. Collect credentials, session tokens, configuration data, and network information.
9. Use the VPN appliance as a foothold to access internal resources and conceal activity by modifying or deleting logs.

How to detect it

Investigate both pre-patch exploitation attempts and post-compromise activity. Useful log sources include VPN authentication logs, web request/access logs, admin audit logs, system/runtime logs, crash/core-dump records, integrity-check reports, file modification timestamps on the appliance, and network telemetry for traffic originating from the VPN appliance. Look for authenticated sessions that access collaboration or meeting-room functionality shortly before service crashes, restarts, segmentation faults, or abnormal memory errors. Review for unusually long meeting-room names, malformed parameters, repeated requests to meeting-related endpoints, or unexpected HTTP 500 responses from collaboration functions. After suspected exploitation, hunt for new or modified web-accessible scripts, unauthorized changes under appliance web or Perl/CGI directories, new scheduled jobs or startup modifications, unexplained outbound connections from the VPN appliance, unexpected DNS lookups, administrator logins not tied to maintenance, and evidence of log clearing. Correlate VPN-assigned client IP activity with internal authentication and endpoint logs to identify lateral movement after the suspected appliance compromise. Because attackers may tamper with local appliance logs, compare appliance logs with upstream reverse proxy, firewall, VPN concentrator, SIEM, EDR, DNS, and NetFlow records where available.

• Pulse Connect Secure version earlier than 9.1R11.4
• Ivanti Connect Secure version earlier than 9.1R11.4
• /dana/meeting/
• /dana/meeting
• meeting room
• Meeting Room
• Secure Meeting
• collaboration
• SIGSEGV
• segmentation fault
• core dumped
• HTTP 500
• /data/var/dlogs
• Integrity Checker Tool
• unexpected file modification in /home/runtime/mt
• unexpected file modification in /data/runtime
• unexpected file modification in /data/var/dlogs

What your security team should do

• Treat any internet-facing appliance running a pre-9.1R11.4 release as potentially compromised because the vulnerability is in CISA KEV and exploitation has been observed in the wild.
• Immediately upgrade all affected Pulse Connect Secure / Ivanti Connect Secure appliances to a fixed supported release, prioritizing externally exposed gateways.
• Run vendor integrity checks and collect forensic images/log exports before major cleanup if compromise is suspected.
• Hunt for authenticated access to meeting-room or collaboration endpoints followed by process crashes, file modifications, new web-accessible scripts, or unusual outbound connections from the appliance.
• Rotate VPN user credentials, administrator passwords, API secrets, and certificates/tokens that may have been exposed on any vulnerable appliance.
• Invalidate active VPN sessions after patching and credential rotation.
• Enforce MFA for all VPN users and administrators and review accounts for unexpected access, disabled MFA, or anomalous login geography.
• Restrict management access and, where possible, user portal access to trusted networks or conditional-access controls.
• Review internal network logs for lateral movement originating from VPN-assigned address ranges during the exposure window.
• If integrity cannot be established, rebuild or replace the appliance from trusted media rather than relying solely on in-place remediation.