0day/00-CVE_EXP/cve-2021-22908

cve-2021-22908

This python3 script checks for Pulse Connect Secure servers vulnerable to VU#667933 CVE-2021-22908. The python requests library is required for operation.

Usage modes:

cve-2021-22908.py <host>
This mode will interactively log in to a PCS server to obtain a DSID value.

cve-2021-22908.py <host> -d <DSID>
In the case were a PCS user's DSID is already known, this mode will skip the interactive login exchange.

cve-2021-22908.py <host> -n
If you do not have authentication available for the target PCS, you can check for only the presence of the Workaround-2105.xml mitigation.

Results:

HTTP 500
This is indicative of a vulnerable PCS server, due to a crashing CGI.

HTTP 403. XML workaround applied
This is indicative of a PCS server that has an XML mitigation applied.

HTTP 200. Windows File Access Policies prevents exploitation.
This is indicative of a PCS server that has "Windows File Access Policies" configured in a way that prevents exploitation.

HTTP %s. Not vulnerable.
The PCS server does not appear to be vulnerable.