Vulnerable Private Networks: Corporate VPNs Exploited in the Wild

Summary: Volexity reported that APT actors began exploiting CVE-2019-11510, an arbitrary file read flaw in Pulse Secure SSL VPNs, roughly a week after researchers detailed it at Black Hat USA on August 7, 2019. Attackers read session databases and files holding cleartext credentials and NTLM hashes, then reused stolen session IDs in a DSID cookie to ride authenticated VPN sessions - including on networks protected by 2FA.
What's compelling: Two-factor authentication did not stop this: once a valid session existed, attackers reused its ID and the legitimate user saw no indication their session was in use elsewhere. Volexity observed widespread exploitation on August 14, 2019, and said organizations that patched on that date or later should treat every credential used or stored on the VPN as compromised.

Read the original at Volexity Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-11510
Related: CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Advisory: Pulse Secure Connect Coverage Cyber Risks ·
Threat Brief: Maze Ransomware Cyber Risks ·