{"uuid": "ade446c7-a0ef-46eb-8bf1-95b0597bb0ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-11539", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Orange Tsai\", \"Meh Chang\", \"wvu \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a post-auth command injection in the Pulse Secure\\n          VPN server to execute commands as root. The env(1) command is used to\\n          bypass application whitelisting and run arbitrary commands.\\n\\n          Please see related module auxiliary/gather/pulse_secure_file_disclosure\\n          for a pre-auth file read that is able to obtain plaintext and hashed\\n          credentials, plus session IDs that may be used with this exploit.\\n\\n          A valid administrator session ID is required in lieu of untested SSRF.\", \"disclosure_date\": \"2019-04-24\", \"fullname\": \"exploit/linux/http/pulse_secure_cmd_exec\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Pulse Secure VPN Arbitrary Command Execution\", \"needs_cleanup\": null, \"notes\": {\"RelatedModules\": [\"auxiliary/gather/pulse_secure_file_disclosure\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/pulse_secure_cmd_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/pulse_secure_cmd_exec\", \"references\": [\"CVE-2019-11539\", \"URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/\", \"URL-https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html\", \"URL-https://hackerone.com/reports/591295\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix In-Memory\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:52.927420Z"}