# Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████

Unpatched Pulse Secure VPN exposed pre-auth path traversal file read of /etc/passwd and cached plaintext creds, chained to post-auth command injection for root RCE.

- Payout: hidden
- Severity: critical
- Program: U.S. Dept Of Defense
- Found by: sp1d3rs
- Disclosed: 2021-07-29
- CVE: CVE-2019-11510, CVE-2019-11542, CVE-2019-11539, CVE-2019-11538, CVE-2019-11508, CVE-2019-11540
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/695005
- Library page: https://bugbountylibrary.com/r/h1%3A695005
- Tags: area:devices domain:network impact:data-leak impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical tech:payment technique:chained vuln:auth-bypass vuln:command-injection vuln:mfa-bypass vuln:path-traversal

**Target:** Pulse Secure SSL VPN web endpoint (/dana-na/html5acc/guacamole)
**Root cause:** Path traversal in the html5acc/guacamole endpoint allows pre-auth arbitrary file read; Pulse Secure also caches plaintext credentials in mtmp lmdb files, enabling auth and post-auth command injection.
**Steps:**
1. `curl -i -k --path-as-is https://TARGET/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/`
2. Read `/data/runtime/mtmp/system` for VPN users/hashes and Duo/LDAP secrets
3. Read `/data/runtime/mtmp/lmdb/dataa/data.mdb` for cached plaintext passwords
4. Read `/data/runtime/mtmp/lmdb/randomVal/data.mdb` to reuse sessions
5. Log into VPN with recovered creds, bypass 2FA via Duo keys or session reuse
6. Access `https://0/admin/` via web proxy and trigger CVE-2019-11539 command injection for root RCE
**How found:** Followed Orange Tsai's BlackHat research on Pulse Secure CVEs and tested the disclosed traversal path against the target instance, confirming /etc/passwd read and then enumerating credential cache files.
**Exploitation:** Attacker reads /etc/passwd and Pulse Secure lmdb files pre-auth, extracts plaintext VPN credentials and Duo integration/secret keys or reusable sessions, authenticates to the VPN bypassing 2FA, then reaches the admin interface via the web proxy and exploits post-auth command injection to execute as root, pivoting into the intranet.
**Escalation:** Chained pre-auth file read -> credential/session theft -> 2FA bypass -> post-auth command injection -> root RCE -> intranet access and VPN client compromise.
**Insight:** Pulse Secure caches plaintext passwords in lmdb files (dataa/data.mdb) and Duo/LDAP secrets in mtmp/system; after any pre-auth file read, always pull these specific paths to convert read into full auth bypass.