CVE-2020-8254: Zip Slip in Pulse Secure VPN Windows Client

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• User interaction (victim needs to click “Yes” or “Always” when asked to download the “Host Checker” software)

Proof Of Concept:

More details and the exploitation process can be found in this PDF.