Orange Tsai - Infiltrating Corporate Intranet Like NSA: Pre-auth RCE on Leading SSL VPNs

SSL VPN Pre-Auth RCE Research

Orange Tsai (Principal Security Researcher, DEVCORE) presents critical vulnerabilities in three leading enterprise SSL VPN products that allow unauthenticated remote code execution — providing direct access to corporate intranets without credentials.

Pulse Secure VPN

CVE-2019-11510: An unauthenticated arbitrary file read in Pulse Secure VPN allows reading cached plaintext credentials from active VPN sessions, providing credential-based access. CVE-2019-11539: Remote code execution via unauthenticated format string injection in the ping diagnostic function.

Fortigate SSL VPN

CVE-2018-13379: Unauthenticated path traversal allows downloading arbitrary files from the Fortigate VPN appliance, including session files containing cleartext VPN credentials and authentication tokens.

Palo Alto GlobalProtect

CVE-2019-1579: Format string vulnerability in the GlobalProtect portal pre-auth request handler allows unauthenticated remote code execution on the VPN gateway.

Mass Exploitation Impact

All three CVEs were actively exploited in the wild within weeks of disclosure by nation-state actors (APT5, suspected Chinese-nexus) to gain persistent access to government and critical infrastructure networks.