CVE-2019-11540

Vulnerability

CVE-2019-11540 is a session hijacking vulnerability in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS). Affected versions are PCS 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1, and PPS 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1. The vulnerability allows an unauthenticated remote attacker to hijack an existing user session without requiring any prior authentication or user interaction.

Exploitation

An attacker can exploit this vulnerability by intercepting or predicting session tokens, or by exploiting weaknesses in the session management implementation. The attack does not require any special network position beyond network access to the affected appliance, and no authentication is needed. The exact exploitation method is not detailed in the available references.

Impact

Successful exploitation allows the attacker to take over an active user session, thereby gaining the same privileges as the legitimate user. This can lead to unauthorized access to internal resources, data exfiltration, or further compromise of the VPN appliance and connected clients.

Mitigation

Pulse Secure released patches on April 24, 2019. Administrators should upgrade to the fixed versions: PCS 9.0R3.4, PCS 8.3R7.1, PPS 9.0R3.2, or PPS 5.4R7.1. No workaround is available. This vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities catalog.