CVE-2021-22899

What it actually does

CVE-2021-22899 is an authenticated command injection vulnerability in Pulse Connect Secure / Ivanti Connect Secure versions before 9.1R11.4. A remote user with valid credentials can abuse the Windows Resource Profiles feature to inject operating-system commands that execute on the appliance. Successful exploitation can provide remote code execution with the privileges of the affected service, enabling compromise of the VPN appliance, access to sensitive configuration or session data, credential theft, persistence, lateral movement, and disruption of VPN availability.

Why it matters to the business

Because the affected product is a perimeter VPN appliance, exploitation can give an attacker a foothold at the edge of the network and may expose credentials, internal access paths, and remote-access sessions. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog with a remediation due date of 2022-05-03 and has been exploited in the wild, so unpatched systems should be treated as high-risk even though exploitation requires authentication. Operational consequences can include unauthorized network access, VPN outage, incident response costs, regulatory exposure, and loss of trust in remote-access infrastructure.

How an attack unfolds

An attacker first obtains valid Pulse Connect Secure credentials through phishing, credential stuffing, password reuse, prior compromise, or abuse of a low-privileged account. After authenticating to the VPN web interface, the attacker accesses functionality related to Windows Resource Profiles and submits crafted input containing command-injection syntax. The vulnerable appliance fails to safely constrain or sanitize that input and passes attacker-controlled content to an operating-system command context. The injected command executes on the appliance, allowing the attacker to run reconnaissance commands, write files, deploy web shells or scripts, collect configuration and credentials, modify settings, and use the VPN appliance as a beachhead for internal network access. Public reporting and KEV status indicate real-world exploitation, so defenders should assume internet-facing unpatched appliances are attractive targets.

How to fix it

Upgrade affected Pulse Connect Secure / Ivanti Connect Secure appliances to version 9.1R11.4 or later. If an immediate upgrade is not possible, restrict administrative and authenticated access to the VPN portal, disable or limit use of Windows Resource Profiles where operationally feasible, enforce multifactor authentication, rotate credentials for accounts that can access the appliance, and monitor for suspicious profile changes or command execution. Because this vulnerability is in the KEV catalog and has been exploited in the wild, mitigation should be treated as temporary only; full remediation requires applying the vendor-fixed release and reviewing the appliance for compromise before returning it to normal trust.

How to confirm the fix worked

Confirm the running appliance version is 9.1R11.4 or later using the administrative console or vendor-supported version check. Review all Pulse Connect Secure / Ivanti Connect Secure nodes, including standby, disaster recovery, lab, and externally exposed appliances. Verify that Windows Resource Profiles no longer accept shell metacharacters or command-substitution payloads in fields that previously reached command execution paths. Run vendor integrity and health-check tooling where available, compare system files and configuration against known-good baselines, and confirm there are no unauthorized resource profiles, administrative accounts, scheduled tasks, web-accessible scripts, or unexpected modified files. Validate that authentication controls, MFA, logging, and external exposure restrictions remain in place after the upgrade.

Typical attack path

1. Identify an internet-facing Pulse Connect Secure / Ivanti Connect Secure appliance.
2. Acquire or reuse valid VPN credentials for the target appliance.
3. Authenticate to the VPN web interface.
4. Navigate to or invoke the Windows Resource Profiles feature.
5. Submit crafted profile input containing operating-system command metacharacters or payloads.
6. Execute arbitrary commands on the appliance through the vulnerable command context.
7. Establish persistence or stage tools, such as scripts, web-accessible files, or modified configuration.
8. Collect credentials, session data, appliance configuration, and network information.
9. Use the compromised VPN appliance to pivot into internal systems or maintain remote access.

How to detect it

Investigate both pre-patch exposure and post-authenticated activity on Pulse Connect Secure / Ivanti Connect Secure appliances. Review web access logs, admin logs, user access logs, resource profile change logs, system event logs, and any exported syslog/SIEM records. Look for authenticated users creating or modifying Windows Resource Profiles followed by suspicious command-like input, unusual process execution, unexpected outbound connections, or file writes on the appliance. Search HTTP request logs for shell metacharacters, command substitution syntax, URL-encoded command separators, and references to common Unix utilities in parameters associated with resource profile creation or modification. Correlate suspicious profile changes with successful VPN logins from unfamiliar IP addresses, impossible travel, hosting-provider source IPs, TOR/VPN egress nodes, or accounts that do not normally manage resource profiles. Examine the appliance filesystem and integrity-check output for unauthorized web-accessible files, modified binaries, unexpected scripts, new administrative accounts, altered configuration, or persistence artifacts. Because exploitation requires authentication, credential compromise indicators such as repeated failed logins followed by success, logins from new countries, and multiple accounts from the same external IP are especially relevant. Also review downstream internal logs for activity originating from VPN address pools shortly after suspicious logins, including scans, remote administration, credential access, and lateral movement.

• 9.1R11.4
• Windows Resource Profiles
• Windows Resource Profile
• Resource Profiles
• ;id
• ; id
• && id
• | id
• `id`
• $(id)
• ;whoami
• ; whoami
• && whoami
• | whoami
• `whoami`
• $(whoami)
• ;uname -a
• && uname -a
• | uname -a
• $(uname -a)
• ;cat /etc/passwd
• && cat /etc/passwd
• | cat /etc/passwd
• $(cat /etc/passwd)
• ;wget
• && wget
• | wget
• ;curl
• && curl
• | curl
• ;nc
• && nc
• | nc
• ;netcat
• && netcat
• | netcat
• /etc/passwd
• /tmp/
• /var/tmp/
• /home/bin/
• /data/runtime/
• /data/var/dlogs/
• command injection
• resource profile

What your security team should do

• Immediately inventory all Pulse Connect Secure / Ivanti Connect Secure appliances and identify any running versions before 9.1R11.4.
• Prioritize emergency patching or replacement of internet-facing appliances because the vulnerability is KEV-listed and exploited in the wild.
• Treat unpatched or historically exposed appliances as potentially compromised; perform forensic review before assuming patching alone is sufficient.
• Review VPN authentication logs for unusual successful logins, especially from new geographies, hosting providers, anonymization services, or accounts with limited normal activity.
• Audit Windows Resource Profiles for suspicious names, parameters, command metacharacters, recent changes, or profiles created by unusual users.
• Rotate passwords and revoke active sessions for users who authenticated to affected appliances during the exposure window; prioritize privileged, administrative, and service accounts.
• Enforce MFA for VPN access and administrative access, and restrict management interfaces to trusted networks.
• Run vendor integrity-check or compromise-assessment tooling if available, and preserve logs and appliance images before remediation where incident response is required.
• Hunt for post-exploitation activity on adjacent internal systems, including unusual VPN-originated connections, credential use, and lateral movement.
• Create SIEM detections for suspicious command-injection characters in resource-profile requests and for unexpected file creation or process execution on VPN appliances.