# Potential pre-auth RCE on Twitter VPN

Unpatched Pulse Secure VPN allowed pre-auth file read of credential/session stores, yielding plaintext passwords and 2FA bypass, chained toward admin command injection RCE.

- Payout: $20,160
- Severity: critical
- Program: X / xAI
- Credited: orange
- Disclosed: 2019-08-10
- CVE: CVE-2019-11510, CVE-2019-11542, CVE-2019-11539, CVE-2019-11538, CVE-2019-11508, CVE-2019-11540
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/591295
- Library page: https://bugbountylibrary.com/r/h1%3A591295
- Tags: domain:infra domain:network impact:data-leak impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical technique:chained technique:default-creds vuln:auth-bypass vuln:command-injection vuln:info-disclosure vuln:mfa-bypass vuln:rce

**Target:** Pulse Secure SSL VPN appliance (*.twitter.com)
**Root cause:** Pulse Secure SSL VPN vulnerable to CVE-2019-11510 pre-auth arbitrary file read; cached plaintext creds and session data in lmdb files enabled auth bypass, and post-auth command injection CVE-2019-11539 chained to RCE.
**Steps:**
1. Exploit CVE-2019-11510 to read `/etc/passwd`, `/etc/hosts`, `/data/runtime/mtmp/system`, `/data/runtime/mtmp/lmdb/dataa/data.mdb`, `lock.mdb`, `randomVal/data.mdb`, `lock.mdb`
2. Grep `mtmp/system` for VPN users/hashed passwords and Duo integration key/secret/LDAP password
3. Grep `dataa/data.mdb` for cached plaintext passwords after user login
4. Reuse session from `randomVal/data.mdb` to bypass 2FA and log into VPN
5. Access admin interface via web proxy `https://0/admin/` to reach post-auth command injection CVE-2019-11539
6. Crack admin hash or wait for admin login to obtain plaintext, then trigger command injection for RCE
**How found:** Researchers monitoring Pulse Secure patch adoption noticed Twitter's VPN unpatched over a month after SA44101; applied known CVE-2019-11510 file-read to pull lmdb stores and inspected them for cached plaintext passwords and session data.
**Exploitation:** Pre-auth file read exposed credential stores and session lmdb; attacker logged in with harvested plaintext creds or reused session token to bypass Duo 2FA, then pivoted through web proxy to admin interface to trigger post-auth command injection, achieving RCE and intranet access.
**Escalation:** Chained pre-auth file read -> credential/session theft -> 2FA bypass -> admin access -> command injection RCE -> intranet access, private keys, and VPN client compromise.
**Insight:** Pulse Secure lmdb files (`dataa/data.mdb`, `randomVal/data.mdb`) cache plaintext passwords and reusable sessions; harvesting these bypasses 2FA without cracking hashes. Monitor patch lag on edge/VPN appliances as an attack surface.