Pulse Connect Secure Administrator Web Interface Arbitrary File Write and Remote Code Execution Vulnerability (CVE-2021-22900) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-22900) is an arbitrary file write flaw residing in the administrator web interface of Pulse Connect Secure (PCS). The root cause lies in the insufficient validation and sanitization of file paths during the extraction of uploaded archive files. An attacker can exploit this by crafting an archive containing directory traversal sequences (e.g., '../../') to bypass directory restrictions and write arbitrary files to the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first obtain authenticated administrator privileges on the PCS appliance. Once authenticated, the attacker targets the archive upload functionality within the admin console. By uploading a specially crafted ZIP or TAR archive containing a web shell or malicious executable mapped to a traversal path, the extraction process writes the payload directly into the web root or other sensitive system directories. The attacker can then access the uploaded web shell to execute arbitrary OS commands with system privileges.

3. Infrastructure & Business Impact

Pulse Connect Secure serves as a critical gateway for enterprise SSL-VPN access. This vulnerability is highly critical and is actively tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog. If an attacker compromises administrative credentials or hijacks an active session, they can gain complete control over the VPN appliance. This allows them to establish a persistent foothold, pivot laterally into the internal corporate network, exfiltrate sensitive data, or deploy ransomware.