Flag Pulse Connect Secure hosts for CVE-2020-8218 by reading version from GET /dana-na/nc/nc_gina_ver.txt. FIXED floor 9.1R8 / 9.1.8. No admin code inject.
What this checks: whether a Pulse Connect Secure host runs a version affected by unauth version leak for admin-interface code injection. Read-only: it fingerprints Pulse Connect Secure and reads the version, no exploitation.
3. Detection — reads the Pulse Connect Secure version from the version exposed at /dana-na/nc/nc_gina_ver.txt, compares to 9.1R8. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Pulse Connect Secure URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Ivanti Pulse Connect Secure and sorts each host by whether its version falls below the CVE-2020-8218 FIXED floor. CVE-2020-8218 is admin-interface code injection on vulnerable Pulse Connect Secure builds. This check never authenticates to admin and never injects code. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /dana-na/nc/nc_gina_ver.txt only, fingerprints Pulse Connect Secure from that version text, reads the release string, and compares it to floor 9.1R8 / 9.1.8 in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a version signal only.
Run it on a schedule when edge VPN appliances lag on maintenance releases. A gateway still below 9.1R8 is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /dana-na/nc/nc_gina_ver.txt on each host and fingerprint Pulse Connect Secure from the version text in that response.
Parse the release string and compare it to the CVE-2020-8218 FIXED floor in the graph (9.1R8 / 9.1.8).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Pulse Connect Secure was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /dana-na/nc/nc_gina_ver.txt only. No admin login and no code injection.
Sample output
The records below are illustrative and do not come from a real run. They show one Pulse Connect Secure host below the CVE-2020-8218 floor, one at or above it, and one host that is not the product.
Which Pulse Connect Secure versions does this flag?
Builds below floor 9.1R8 / 9.1.8, the single FIXED floor coded in the graph. The compare uses the version text /dana-na/nc/nc_gina_ver.txt itself served.
Does an affected row mean admin code injection worked?
No. The check only GETs /dana-na/nc/nc_gina_ver.txt and reads the version string. It does not log into admin and it does not confirm code injection.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public version endpoint. It does not authenticate or inject code.
Does the check need credentials?
No. It fingerprints the public version text the way an external scanner would.
What is CVE-2020-8218?
Admin-interface code injection in Ivanti Pulse Connect Secure on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.