CVE-2021-22900

What it actually does

This flaw is an authenticated arbitrary file-write vulnerability in Pulse Connect Secure / Ivanti Connect Secure versions before 9.1R11.4. A user with administrator access to the web administration interface can upload a maliciously crafted archive that is not sufficiently validated, allowing files inside the archive to be written outside the intended upload location. Depending on the target path and appliance permissions, this can be used to place executable files, overwrite configuration, modify scripts, or stage persistence, with potential compromise of confidentiality, integrity, and availability of the VPN appliance.

Why it matters to the business

Because the affected product is an internet-facing remote-access VPN platform, successful exploitation can give an attacker a durable foothold at the network edge after they obtain or abuse administrator credentials. Consequences can include appliance takeover, theft of VPN configuration or session data, credential harvesting, persistence for later intrusion, disruption of remote access, and use of the VPN as a trusted entry point into internal systems. This vulnerability is listed in CISA KEV with active exploitation observed in the wild and had a remediation due date of 2022-05-03, so any remaining exposure should be treated as overdue and high priority even though exploitation requires administrator privileges.

How an attack unfolds

An attacker first obtains administrative access to the Pulse Connect Secure / Ivanti Connect Secure administrator interface, commonly through stolen credentials, credential stuffing, prior appliance compromise, or abuse of another vulnerability. After authenticating, the attacker submits an archive through the administrator web interface that contains crafted file paths, such as traversal sequences or otherwise unsafe archive entries. Because vulnerable versions do not properly restrict where extracted files can be written, the appliance writes attacker-controlled content to a chosen location. The attacker may then use the written file as a web shell, persistence mechanism, configuration modification, or staging file, and may access it over the appliance web interface or wait for the appliance to execute or load the modified content. In real intrusions against VPN appliances, this class of activity is often paired with log tampering, credential theft, and lateral movement from the trusted remote-access perimeter.

How to fix it

Upgrade affected Pulse Connect Secure / Ivanti Connect Secure appliances to version 9.1R11.4 or later. If direct upgrade is not immediately possible, restrict administrator interface access to a tightly controlled management network or VPN, enforce multifactor authentication for administrators, rotate all administrator credentials, disable or limit unnecessary administrative upload/import functions where supported, and monitor for suspicious archive upload activity. Because this vulnerability is in CISA KEV and the remediation deadline has long passed, prioritize replacement or isolation of any appliance that cannot be upgraded. After patching, review appliance integrity guidance from the vendor and consider rebuilding from trusted media if compromise is suspected.

How to confirm the fix worked

Confirm the appliance software version is 9.1R11.4 or later and that no unsupported or end-of-life release remains in service. Verify that the administrator interface is not exposed to the public internet unless absolutely required and is protected by network allowlisting and multifactor authentication. Review administrative audit logs to confirm only expected users performed upload/import actions. Where safe and authorized, test with a benign archive containing traversal-style filenames and confirm the appliance rejects or safely normalizes the upload without writing outside the intended directory. Perform file integrity checks on web-accessible directories, startup scripts, configuration files, and recently modified files around the time of any suspicious administrator activity.

Typical attack path

1. Identify an exposed Pulse Connect Secure / Ivanti Connect Secure administrator interface.
2. Acquire valid administrator credentials or gain administrator access through another compromise path.
3. Authenticate to the administrator web interface.
4. Upload a maliciously crafted archive containing unsafe file paths or attacker-controlled files.
5. Cause the appliance to extract or process the archive, resulting in file write outside the intended directory.
6. Use the newly written file to execute commands, establish persistence, alter appliance behavior, or stage additional tooling.
7. Collect credentials, session data, configuration, or use the VPN appliance as a foothold for further network access.
8. Attempt to hide activity by deleting uploaded artifacts, modifying timestamps, or clearing appliance logs.

How to detect it

To determine whether this was already exploited, collect and review appliance administrator audit logs, web access logs for the admin interface, system logs, file modification timestamps, configuration change history, and any available endpoint or network telemetry from adjacent monitoring. Focus on authenticated administrator sessions followed by archive upload, import, restore, or package-management actions, especially from unusual source IPs, unusual geographies, new administrator accounts, or sessions outside normal maintenance windows. Inspect uploaded archive names and web requests for path traversal sequences, encoded traversal, absolute paths, or suspicious extensions. Examine appliance directories that serve web content or execute scripts for newly created or recently modified files, especially files with script extensions or files whose timestamps align with administrator upload events. Look for web requests to newly created files after an upload, unexpected child processes spawned by web-facing appliance services, outbound connections from the appliance to unfamiliar hosts, and evidence of log deletion or truncation. Because exploitation requires administrator privileges, also investigate how the administrator access was obtained, including credential theft, reused passwords, MFA bypass, or exploitation of a separate vulnerability.

• /dana-admin/
• ../
• ..%2f
• %2e%2e%2f
• ..%5c
• %2e%2e%5c
• tar
• tgz
• zip
• upload
• import
• restore
• backup
• admin upload
• archive upload
• .jsp
• .php
• .cgi
• .pl
• .sh
• authorized_keys
• webshell
• cmd=
• exec=
• whoami
• /bin/sh
• /bin/bash

What your security team should do

• Immediately inventory all Pulse Connect Secure / Ivanti Connect Secure appliances and confirm none are running versions before 9.1R11.4.
• Prioritize remediation as overdue because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Restrict administrator interface access to dedicated management networks and remove direct internet exposure wherever possible.
• Enforce multifactor authentication and strong credential rotation for all appliance administrator accounts.
• Review administrative audit logs for unexpected archive upload, import, backup, restore, or package-management actions.
• Search the appliance filesystem and backups for recently created or modified web-accessible scripts, unexpected binaries, and archive extraction artifacts.
• If suspicious file writes are found, treat the VPN appliance as potentially compromised: preserve evidence, isolate it, rotate credentials and certificates, and rebuild or restore from trusted media.
• Correlate VPN authentication logs with downstream access logs to identify possible lateral movement following suspected exploitation.