CVE-2021-22893: Ivanti Connect Secure Auth Bypass Flaw

CVE-2021-22893 Overview

CVE-2021-22893 is a critical authentication bypass vulnerability in Pulse Connect Secure (now Ivanti Connect Secure) versions 9.0R3/9.1R1 and higher. The vulnerability is exposed through the Windows File Share Browser and Pulse Secure Collaboration features, allowing an unauthenticated attacker to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been confirmed as actively exploited in the wild by sophisticated threat actors.

Critical Impact
This vulnerability enables complete compromise of Pulse Connect Secure VPN appliances without authentication, granting attackers persistent access to enterprise networks. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog.

Affected Products

Ivanti Connect Secure 9.0R3 through 9.0R6.0
Ivanti Connect Secure 9.1R1 through 9.1R11.3
Pulse Connect Secure (legacy branding) versions 9.0R3 and 9.1R1 and higher

Discovery Timeline

April 23, 2021 - CVE-2021-22893 published to NVD
December 18, 2025 - Last updated in NVD database

Technical Details for CVE-2021-22893

Vulnerability Analysis

This vulnerability combines authentication bypass (CWE-287) with a use-after-free condition (CWE-416), creating a devastating attack chain that allows unauthenticated remote code execution. The flaw resides in the Windows File Share Browser and Pulse Secure Collaboration features, which fail to properly validate authentication states before processing user-supplied requests. The network-accessible attack surface requires no user interaction and allows attackers to change the scope of impact, potentially compromising internal networks that the VPN gateway connects to.

The use-after-free component enables attackers to manipulate memory after it has been freed, potentially allowing arbitrary code execution in the context of the VPN appliance. Combined with the authentication bypass, this creates a zero-click attack vector against critical network infrastructure.

Root Cause

The root cause stems from improper authentication validation in the Windows File Share Browser and Pulse Secure Collaboration components. These features fail to properly enforce authentication requirements, allowing unauthenticated users to access functionality that should require valid credentials. Additionally, the use-after-free condition indicates memory management issues where freed memory pointers are subsequently dereferenced, enabling memory corruption and potential code execution.

Attack Vector

The attack is conducted over the network against the Pulse Connect Secure gateway's web interface. An unauthenticated attacker can craft malicious requests targeting the Windows File Share Browser or Pulse Secure Collaboration features, bypassing authentication controls. The low complexity and lack of required user interaction make this an ideal target for automated exploitation. Successful exploitation grants attackers complete control over the VPN gateway, enabling lateral movement into protected network segments.

The vulnerability mechanism involves sending specially crafted requests to the vulnerable endpoints that trigger the authentication bypass, followed by exploitation of the use-after-free condition to achieve code execution. Detailed technical analysis is available in the FireEye Threat Research Article.

Detection Methods for CVE-2021-22893

Indicators of Compromise

Unusual authentication logs showing access to Windows File Share Browser or Collaboration features without valid session tokens
Unexpected web shell files or modified system files on the Pulse Connect Secure appliance
Anomalous outbound connections from the VPN gateway to unknown external IP addresses
Modified DSA/RSA keys or certificates on the appliance
Presence of known malware families associated with exploitation campaigns (e.g., SLOWPULSE, RADIALPULSE, THINBLOOD)

Detection Strategies

Deploy Pulse Secure's Integrity Checker Tool to identify modified or unauthorized files on appliances
Monitor authentication logs for attempts to access vulnerable features without proper authentication
Implement network traffic analysis to detect command and control communications from VPN gateways
Review web server access logs for suspicious requests targeting /dana/ and /dana-na/ URI paths

Monitoring Recommendations

Enable verbose logging on all Pulse Connect Secure appliances and forward logs to a SIEM
Implement file integrity monitoring on critical appliance system files and configurations
Establish baseline network behavior for VPN appliances and alert on deviations
Monitor for new or modified scheduled tasks and startup scripts on the appliance

How to Mitigate CVE-2021-22893

Immediate Actions Required

Apply the security patches from Ivanti/Pulse Secure immediately if not already patched
Run the Pulse Secure Integrity Checker Tool to detect any evidence of compromise
Disable Windows File Share Browser and Pulse Secure Collaboration features if not required
Implement network segmentation to limit lateral movement from VPN gateways

Patch Information

Ivanti (formerly Pulse Secure) has released security patches addressing this vulnerability. Administrators should upgrade to the latest patched version of Ivanti Connect Secure. Detailed patch information and download links are available in the Pulse Secure Security Advisory SA44784. Additional guidance is provided in the Pulse Secure Security Update blog post.

Workarounds

Disable the Windows File Share Browser feature through the admin console if patches cannot be immediately applied
Disable Pulse Secure Collaboration (Meeting) feature if not actively required
Restrict network access to the Pulse Connect Secure management interface to trusted IP ranges only
Consider implementing additional network controls such as web application firewalls in front of VPN appliances

bash

# Workaround: Disable Windows File Share Browser via XML configuration
# Import the workaround XML provided by Pulse Secure
# Access: System > Maintenance > Import/Export > Import XML
# Download workaround from Pulse Secure KB article SA44784