What this checks: whether a Pulse Connect Secure / Pulse Policy Secure host runs a version affected by authenticated admin OS command injection (CWE-78). Read-only: it fingerprints Pulse Connect Secure / Pulse Policy Secure and reads the version, no exploitation.
3. Detection — reads the Pulse Connect Secure / Pulse Policy Secure version from the version exposed at /dana-na/nc/nc_gina_ver.txt, compares to per branch: 8.1R15.1 (ProductVersion 8.1.15.59747) / 8.2R12.1 (8.2.12.64003) / 8.3R7.1 (8.3.7.65025) / 9.0R3.4 (9.0.3.64053); 9.1R1 and above are not affected. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Pulse Connect Secure / Pulse Policy Secure URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Ivanti Pulse Connect Secure hosts where admin interfaces on vulnerable builds allow command injection, tracked as CVE-2019-11539. Give it hostnames, IP addresses, or CIDR ranges you are authorised to test. It fingerprints exposure and version without authenticating or injecting commands. Use the per-host verdict in exposure management to prioritise patching, not as proof of exploitability. The check stays non-destructive end to end.
Pipeline
Normalize the input scope into a bare host list.
Probe each host for product exposure signals used by this check.
Read version or build evidence from unauthenticated responses where available.
Compare that evidence to the known affected range for CVE-2019-11539.
Emit one JSONL record per host with the verdict, plus a summary line.
Inputs
Target scope. Hostnames, IP addresses, or CIDR ranges, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
Affected host list. Hosts whose fingerprint falls in the affected range for CVE-2019-11539, kept apart from the patched ones.
Per-target evidence. For each host: whether the product was detected, the version or build read, and the verdict, so you can check a finding instead of trusting it.
Final report. A JSON summary counting affected, patched, and verify-manually hosts across the whole list.
Integrations
HTTP fingerprinting for product and version signals.
Sample output
The records below are illustrative and do not come from a real run. They show the shape of a fingerprint verdict for CVE-2019-11539.
Does an affected verdict mean the host is exploitable right now?
No. The workflow fingerprints exposure and version without authenticating or injecting commands. Treat the verdict as a patching signal. It does not prove exploitability on that host.
What scope should I pass in?
Hostnames, IP addresses, or CIDR ranges you are authorised to test. Prefer the edge or CI hosts where Ivanti Pulse Connect Secure is expected, so the fingerprint has somewhere to land.
Will this send exploit payloads?
No. Detection stays read-only: exposure and version fingerprint only, matching the workflow README.