8.2 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Ivanti's Secure Access Client (formerly Pulse Secure Access Client), an enterprise VPN client, is vulnerable to improper input validation. The vulnerability exists inside one of the kernel drivers included in the software package named `jnprva.sys`. Exploiting this vulnerability could lead to a denial of service of the local system.
The bug has been present since at least 2018. At least the following versions are affected.
- Pulse Secure VPN version 9.1R18 and lower.
- Ivanti Secure Access version 22.6R1 and lower.
Several IOCTL handlers (for example `0x80002018`) inside the `jnprva.sys` driver perform pointer dereferences on improperly validated input data. Passing an invalid pointer value for the following input field will result in a blue screen:
- 16-03-2023 – Initial notice to DIVD
- 20-03-2023 – First reply from Ivanti regarding their responsible disclosure policy
- 13-06-2023 – Northwave shares vulnerability details and PoC with Ivanti
- 09-09-2023 – Ivanti notifies Northwave of planned patch release date
- 17-10-2023 – Planned Vendor Patch Release (not achieved)
- 09-11-2023 – Vendor Patch Release
- 09-11-2023 – Public Release
Discovered by Tijme Gommers & Alex Oudenaarden of Northwave Cybersecurity.
Northwave has made every effort to make this information accurate and reliable. However, the information provided is without warranty of any kind and its use is at the sole risk of the user. Northwave does not accept any responsibility or liability for the accuracy, content, completeness, legality or reliability of the information provided. We shall not be liable for any loss or damage of whatever nature, direct or indirect, consequential or other, whether arising in contract, tort or otherwise, which may arise as a result of your use of, or inability to use, this information or any additional information provided by us in direct or indirect relation to the information provided here.