CVE-2021-3047 in PAN-OS
Summary
by MITRE • 08/12/2021
A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to impersonate another authenticated web interface administrator's session. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.4. PAN-OS 10.1 versions are not impacted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2021
The vulnerability described in CVE-2021-3047 represents a critical weakness in the cryptographic implementation of Palo Alto Networks PAN-OS web interface authentication mechanisms. This issue stems from the use of a cryptographically weak pseudo-random number generator during the authentication process, which fundamentally undermines the security of administrative sessions. The flaw specifically affects multiple major versions of PAN-OS including 8.1, 9.0, 9.1, and 10.0, with the vulnerability being resolved in the subsequent patch releases. The weakness in the PRNG implementation creates a predictable pattern in session tokens or authentication secrets that can be exploited by determined attackers.
The technical exploitation of this vulnerability relies on an authenticated attacker who can observe their own authentication secrets over an extended period. This observation capability allows the attacker to analyze the predictable patterns generated by the weak PRNG and subsequently impersonate other authenticated administrators. The attack vector requires the adversary to first gain valid credentials through legitimate means, but once achieved, the weak cryptographic foundation enables session hijacking. This particular weakness falls under the CWE-330 category of 'Use of Insufficiently Random Values' and represents a significant deviation from established cryptographic best practices for session management and authentication token generation.
The operational impact of this vulnerability extends beyond simple session hijacking to encompass complete administrative compromise of the network security appliance. An attacker who successfully exploits this weakness can assume the identity of any authenticated administrator, potentially gaining access to sensitive configuration data, modifying security policies, and controlling network traffic flow. The vulnerability affects the core web interface functionality that administrators rely upon for device management, making it particularly dangerous as it undermines the fundamental trust model of the security appliance. This type of attack aligns with ATT&CK technique T1566.001 for credential access through credential dumping and T1566.002 for credential access through phishing, though the specific exploitation method targets session tokens rather than primary credentials.
Organizations running affected PAN-OS versions should implement immediate remediation measures including upgrading to the patched versions mentioned in the advisory. The vulnerability requires no special privileges beyond initial authentication, making it particularly concerning for environments where administrative access is frequently required. Network segmentation and monitoring of web interface traffic should be enhanced to detect potential exploitation attempts, as the weak PRNG patterns may be observable through traffic analysis. The incident response plan should include immediate revocation of all administrative sessions and credential rotation for all administrators, as the compromised cryptographic foundation could affect multiple sessions simultaneously. This vulnerability highlights the importance of proper cryptographic implementation in security-critical applications and demonstrates how seemingly minor weaknesses in random number generation can lead to complete administrative compromise.