CVE-2024-5906 in Prisma Cloud Compute
Summary
by MITRE • 06/12/2024
A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to perform actions in the context of another user's browser when accessed by that other user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/24/2025
The vulnerability CVE-2024-5906 represents a critical cross-site scripting flaw within Palo Alto Networks Prisma Cloud Compute software that specifically targets the identity provider configuration functionality. This vulnerability operates at the application layer and exploits the web interface's insufficient input validation mechanisms when processing user-supplied data for identity provider configurations. The flaw exists in the software's handling of administrator inputs where JavaScript payloads can be injected and stored persistently within the system's configuration management interface.
This XSS vulnerability specifically affects administrators who possess add or edit permissions for identity providers within the Prisma Cloud Compute environment. The attack vector requires a malicious administrator to leverage their existing privileges to inject malicious JavaScript code through the web interface. The vulnerability is particularly concerning because it allows the attacker to store the malicious payload within the system's configuration, making it persistent and automatically executed whenever legitimate users access the affected functionality. The stored payload executes in the context of other users' browsers, effectively enabling the malicious administrator to impersonate or perform unauthorized actions on behalf of those users.
The operational impact of this vulnerability extends beyond simple data exfiltration or session hijacking. The malicious administrator can execute arbitrary JavaScript code in the browser context of other users, potentially leading to complete account compromise, privilege escalation, or data manipulation within the Prisma Cloud Compute environment. This type of vulnerability directly violates the principle of least privilege and can enable attackers to gain unauthorized access to sensitive security configurations, potentially compromising the entire cloud security posture managed by Prisma Cloud Compute. The attack can be particularly devastating in environments where administrators have elevated privileges and where the software controls critical security policies and access controls.
From a cybersecurity framework perspective, this vulnerability maps directly to CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript, demonstrating how a compromised administrator account can be leveraged to execute malicious code against other users. The vulnerability also reflects weaknesses in input validation and output encoding controls, which are fundamental requirements in secure software development practices. Organizations should implement immediate mitigations including enhanced input validation, proper output encoding, and strict access controls to prevent unauthorized administrators from injecting malicious code. Additionally, regular security assessments and monitoring of configuration changes can help detect and prevent exploitation of this vulnerability. The remediation efforts should focus on strengthening the web application's security controls around user input handling and ensuring that all stored data is properly sanitized before being rendered in user interfaces.