CVE-2019-11510 Pulse Connect Secure (PCS) SSL VP.N arbitrary file read vulnerability

There is a file in any Pulse Secure's Pulse Connect Secure (PCS) SSL VPN products read vulnerability, an attacker can read arbitrary files without authentication.

Affected:

Less than 8.1R15.1

8.2 ~ 8.2R12.1

8.3 ~ 8.3R7.1

9.0 ~ 9.0R3.4

PoC script:

GitHub：https://github.com/imjdl/CVE-2019-11510-poc

GitHub：https://github.com/projectzeroindia/CVE-2019-11510

MetasploitModule: https: //www.exploit-db.com/exploits/47297

Vulnerability detection:

Google can be found to some of the Pulse Connect Secure (PCS) VPN log entry, use these search results were PoC testing, I tried five or six goals, succeeded once.

FOFA can be found to some of the Pulse Connect Secure (PCS) VPN equipment, the successful read / etc / passwd file using the PoC detection script.

Reference links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11510