Palo Alto VM Series Firewall for Microsoft Azure TechSupport Files credentials management

Summaryinfo

A vulnerability, which was classified as critical, has been found in Palo Alto VM Series Firewall for Microsoft Azure. This affects an unknown part of the component TechSupport Files Handler. Performing a manipulation results in credentials management. This vulnerability is cataloged as CVE-2020-1978. The attack must be initiated from a local position. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Palo Alto VM Series Firewall for Microsoft Azure (Cloud Software) (affected version unknown). It has been classified as problematic. This affects an unknown functionality of the component TechSupport Files Handler. The manipulation with an unknown input leads to a credentials management vulnerability. CWE is classifying the issue as CWE-255. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves. This issue affects VM Series Plugin versions before 1.0.9 for PAN-OS 9.0. This issue does not affect VM Series in non-HA configurations or on other cloud platforms. It does not affect hardware firewall appliances. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the tech support files with the credentials. We now filter and remove these credentials from all TechSupport files sent to us. The TechSupport files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials.

The weakness was shared 04/08/2020. This vulnerability is uniquely identified as CVE-2020-1978 since 12/04/2019. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Palo Alto

Name

• VM Series Firewall for Microsoft Azure

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion