CVE-2022-21826: ivanti connect_secure HTTP Request/Response Smuggling

Vulnerability summary

CVE-2022-21826 is a medium (CVSS 5.4) HTTP Request/Response Smuggling vulnerability in ivanti connect_secure. EPSS estimates a 46.02% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities.

Timeline

1. 30-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.