CVE-2021-22900: Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability

CVE-2021-22900 is an unrestricted file upload flaw in Ivanti Pulse Connect Secure. An authenticated administrator can upload a maliciously crafted archive through the administrator web interface and cause an arbitrary file write on the appliance. Because Pulse Connect Secure often sits at the edge as a remote-access gateway, a successful write can let an attacker plant code or alter configuration, turning a compromised admin session into deeper control of the VPN infrastructure.

Organizations that rely on this product for employee or partner access should treat the issue as high priority until they confirm their appliances are patched per the vendor advisory. Public detail beyond the CISA description is limited; always verify exact impact and fixed releases against Ivanti’s guidance.

How it works

The weakness is classified as CWE-94 (code injection) and manifests as unrestricted file upload. In normal operation the administrator web interface accepts archive uploads for legitimate maintenance or configuration tasks. The vulnerable logic fails to adequately constrain the contents or destination of those archives. An attacker who already holds valid administrator credentials can craft an archive that, when processed, writes attacker-chosen files to locations the appliance should not allow. Once a file is written, the attacker may achieve code execution, persistence, or further configuration changes, depending on what the written content can influence. No unauthenticated remote path is described; the prerequisite is an authenticated admin session.

Am I affected? How to find it in your systems

Pulse Connect Secure appliances are typically deployed as physical or virtual VPN gateways, often in DMZs or edge networks, and are managed through a dedicated administrator web console. Inventory every instance by:

• Querying network management, CMDB, or vulnerability-scan data for hosts identifying as Ivanti/Pulse Secure Connect Secure.
• Reviewing firewall and load-balancer rules that forward traffic to the admin interface (commonly on a dedicated management IP or port).
• Checking the appliance’s own system information or “About” page for product and build identifiers; compare those identifiers with the fixed versions listed in the vendor advisory.

Because exploitation requires administrator authentication, look for anomalous admin logins, unexpected archive uploads, or file-system changes around the time of any suspected compromise. Centralized logs from the appliance, authentication servers, and any web-application firewall in front of the admin interface are the primary telemetry sources. Confirm exact version ranges and indicators of compromise against the vendor advisory; do not rely solely on generic signatures.

How to remediate

The required action is to apply the updates published by Ivanti for Pulse Connect Secure. Follow the vendor’s installation and reboot procedures exactly; partial or out-of-order updates can leave residual risk. After patching:

• Re-validate that the running build matches a fixed release.
• Rotate any administrator credentials that may have been exposed or shared.
• Review and tighten file-upload and archive-handling policies on the appliance if the product still exposes such functions.
• Ensure the administrator interface is reachable only from tightly controlled management networks.

Document the change and retain pre- and post-patch configuration snapshots for later audit.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the management interface so it is reachable only from a jump host or privileged-access workstation network; block direct internet or general corporate access.
• Place a web-application firewall or reverse proxy in front of the admin console and enable rules that restrict archive upload endpoints or inspect uploaded content for unexpected file types and paths.
• Temporarily disable or restrict any non-essential archive-upload features if the product configuration allows it.
• Increase monitoring: alert on admin authentications from unusual source IPs, failed or successful archive uploads, and unexpected process or file-system activity on the appliance.
• Enforce multi-factor authentication and short session timeouts for all administrator accounts.

These measures do not eliminate the vulnerability; they only raise the bar until the official patch is installed.

If your data may have been exposed

Actively exploited edge vulnerabilities frequently lead to broader network compromise and data theft. If you have reason to believe an attacker obtained administrator access or wrote malicious files, treat the incident as a potential breach: isolate the appliance, preserve logs and disk images, and begin forensic review. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps.