CVE-2021-22900: Ivanti Connect Secure RCE Vulnerability

CVE-2021-22900 Overview

CVE-2021-22900 is a high-severity unrestricted file upload vulnerability affecting Pulse Connect Secure (now Ivanti Connect Secure) VPN appliances before version 9.1R11.4. The vulnerability enables an authenticated administrator to perform arbitrary file writes via maliciously crafted archive uploads through the administrator web interface. This flaw has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Critical Impact

Authenticated administrators can leverage malicious archive uploads to write arbitrary files to the system, potentially leading to remote code execution and complete appliance compromise.

Affected Products

• Ivanti Connect Secure versions 9.0 through 9.1R11.3
• Pulse Secure Pulse Connect Secure versions prior to 9.1R11.4
• All Ivanti Connect Secure 9.x release branches before the security patch

Discovery Timeline

• May 27, 2021 - CVE-2021-22900 published to NVD
• December 18, 2025 - Last updated in NVD database

Technical Details for CVE-2021-22900

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection) and CWE-669 (Incorrect Resource Transfer Between Spheres). The flaw exists in the administrator web interface's archive upload functionality, which fails to properly validate and sanitize uploaded archive contents before extraction.

When an authenticated administrator uploads an archive file through the web interface, the application does not adequately verify the contents of the archive or restrict where files can be written during extraction. This allows an attacker with administrator credentials to craft a malicious archive containing path traversal sequences or specially constructed file structures that, when processed by the appliance, result in arbitrary file writes to sensitive system locations.

The vulnerability requires administrator-level authentication, which limits the initial attack surface. However, given that Pulse Connect Secure appliances have been heavily targeted by threat actors, compromised administrator credentials are a realistic attack scenario. Once exploited, the arbitrary file write capability can be leveraged to achieve remote code execution by overwriting critical system files or placing webshells in accessible locations.

Root Cause

The root cause is the lack of proper input validation and sanitization in the archive processing functionality within the Pulse Connect Secure administrator interface. The application fails to implement secure archive extraction practices, such as validating file paths within the archive to prevent directory traversal attacks or restricting file write operations to designated safe directories. This allows maliciously crafted archives to escape the intended extraction directory and write files to arbitrary locations on the filesystem.

Attack Vector

The attack requires network access to the Pulse Connect Secure administrator web interface and valid administrator credentials. An attacker must craft a malicious archive file containing files with manipulated paths or symbolic links designed to write content outside the intended upload directory.

The exploitation flow involves:

1. The attacker gains or compromises administrator credentials for the Pulse Connect Secure appliance
2. The attacker creates a malicious archive containing files with path traversal sequences (e.g., ../../../etc/passwd) or symbolic links pointing to sensitive system locations
3. The attacker uploads the malicious archive through the administrator web interface
4. The vulnerable archive processing routine extracts the contents without proper path validation
5. Files are written to attacker-controlled locations on the filesystem
6. The attacker leverages the arbitrary file write to achieve code execution, such as by placing a webshell in a web-accessible directory

This is a post-authentication vulnerability, meaning the attacker must first obtain valid administrator credentials through other means such as phishing, credential stuffing, or exploitation of other vulnerabilities.

Detection Methods for CVE-2021-22900

Indicators of Compromise

• Unexpected file modifications in system directories outside normal Pulse Connect Secure operational paths
• Presence of webshells or unauthorized scripts in web-accessible directories
• Anomalous archive upload activity in administrator audit logs
• Unauthorized configuration changes or new administrator accounts

Detection Strategies

• Monitor administrator web interface access logs for unusual archive upload patterns or high-frequency uploads
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file writes
• Review Pulse Connect Secure system logs for archive extraction errors or path traversal attempts
• Cross-reference administrator login events with known legitimate administrator activity patterns

Monitoring Recommendations

• Enable comprehensive audit logging on Pulse Connect Secure appliances and forward logs to a SIEM solution
• Configure alerts for administrator authentication events, especially from unexpected source IP addresses
• Implement network-based detection for anomalous traffic patterns to the administrator interface
• Regularly review the CISA KEV catalog and threat intelligence feeds for updated indicators related to Pulse Secure exploitation

How to Mitigate CVE-2021-22900

Immediate Actions Required

• Upgrade Pulse Connect Secure / Ivanti Connect Secure to version 9.1R11.4 or later immediately
• Review administrator accounts for unauthorized access and reset all administrator credentials
• Audit recent archive upload activity in administrator logs for suspicious uploads
• Run the Pulse Secure Integrity Checker Tool to identify potential compromise indicators

Patch Information

Ivanti (formerly Pulse Secure) has released a security patch addressing this vulnerability. Organizations should upgrade to Pulse Connect Secure version 9.1R11.4 or later, which includes fixes for this unrestricted file upload vulnerability. Refer to the Pulse Secure Security Advisory SA44784 for detailed patch information and upgrade instructions.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, federal agencies and critical infrastructure organizations should prioritize remediation according to CISA's binding operational directive timelines.

Workarounds

• Restrict network access to the administrator web interface to trusted management networks only using firewall rules
• Implement multi-factor authentication (MFA) for all administrator accounts to reduce credential compromise risk
• Disable the archive upload functionality if not required for operational purposes until patching is complete
• Deploy web application firewall (WAF) rules to detect and block malicious archive upload attempts

# Example: Restrict admin interface access to trusted management subnet
# Apply via network firewall or ACL configuration
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <pulse-secure-admin-ip> -j DROP