Pulse Secure Client SetupService 目录遍历本地权限提升漏洞

该漏洞允许本地攻击者利用 SetupService 组件中的缺陷，通过构造恶意路径访问系统中的敏感文件或执行恶意代码。攻击者首先需要能够在目标系统上执行低权限代码才能利用此漏洞。成功利用此漏洞可能导致攻击者完全控制受影响的系统，窃取敏感数据，安装恶意软件，或进行进一步的横向移动。由于该漏洞允许权限提升，因此攻击者可以绕过正常的安全控制，从而扩大攻击范围。

Organizations utilizing Pulse Secure Client for remote access, particularly those running versions 9.1r15 through 9.1r15, are at risk. Systems with weak access controls or those where local accounts have excessive privileges are especially vulnerable. Environments with a history of insider threats or where physical access to client machines is readily available should prioritize remediation.

• windows / supply-chain:

Get-Process -Name SetupService | Select-Object ProcessId, Path

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Pulse Secure Client SetupService']]]" | Select-Object TimeCreated, Message

• windows / supply-chain: Check Autoruns for unusual entries related to Pulse Secure Client or SetupService.

1. 2024-05-03Disclosure

   disclosure

1. 已保留2023-05-31
2. 发布日期2024-05-03
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

Pulse Secure 建议用户尽快升级到已修复的版本。如果无法立即升级，可以考虑以下缓解措施：限制对 SetupService 组件的访问权限，实施严格的访问控制策略，并监控系统日志以检测可疑活动。此外，可以考虑使用 Web 应用防火墙 (WAF) 或代理服务器来过滤恶意请求。升级后，请确认漏洞已修复，可以通过检查 SetupService 组件的配置和文件权限来验证。