Embattled VPN technology vendor Pulse Secure on Monday updated an “out-of-cycle” advisory with patches for four major security vulnerabilities, including belated cover for an issue that’s already been exploited by advanced threat actors.
The most serious of the four issues — CVE-2021-22893 — covers multiple memory corruption flaws in the Pulse Connect Secure product that could allow remote, unauthenticated code execution attacks via license server web services.
When Pulse Secure released its initial advisory for the bug on April 20, FireEye reported seeing this and three other Pulse Secure VPN appliance vulnerabilities being exploited as an initial access vector by at least two sophisticated threat actors. The CVE-2021-22893 flaw was the only zero-day — the other three Pulse Secure vulnerabilities believed to have been used in these attacks (CVE-2019-11510, CVE-2020-8243 and CVE-2020-8260) were patched in 2019 and 2020.
The attacks described at the time by FireEye were attributed to two threat groups: UNC2630, which targeted defense industrial base companies in the United States and which has been linked to the Chinese government and a group tracked as APT5; and UNC2717, which targeted global government agencies but which hasn’t been linked to any known threat group.
FireEye has identified several new malware families associated with the exploitation of Pulse Secure VPN appliances. This malware includes trojans, backdoors and web shells tracked as SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, PULSECHECK, HARDPULSE, QUIETPULSE, and PULSEJUMP.
The new Pulse Secure advisory also provides cover for three additional issues that expose users to remote code execution and command injection attacks. Two of the three vulnerabilities — CVE-2021-22894 and CVE-2021-22899 — carry CVSS scores of 9.9 and are rated “critical.” However, exploitation, which involves specially crafted meeting rooms and Windows file resource profiles, requires authentication.
“We recommend that customers move quickly to apply the update to ensure they are protected,” said Pulse Secure chief security officer Phil Richards.
Richards also recommended the use of the company’s Pulse Security Integrity Checker Tool to help customers identify malicious activity on their systems, and continue to apply and follow recommended guidance for all available security patches.
“Companywide we are making significant investments to enhance our overall cyber security posture, including a more broad implementation of secure application development standards,” he added.
It’s not uncommon for threat actors to target vulnerabilities in Pulse Secure products. Over the past few years, flaws in Pulse Secure VPN appliances have been exploited by both state-sponsored threat actors and profit-driven cybercrime groups.
* Additional reporting by Eduard Kovaks.
Related: CISA: Pulse Secure VPN Vulnerability Still Widely Exploited
Related: ‘Black Kingdom’ Ransomware Target Pulse Secure VPNs
Related: NSA: Russian Hackers Exploiting VPN Vulnerabilities