Palo Alto PAN-OS up to 8.0.x/8.1.14/9.0.8/9.1.2 SAML Authentication signature verification

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Palo Alto PAN-OS up to 8.0.x/8.1.14/9.0.8/9.1.2. Impacted is an unknown function of the component SAML Authentication. This manipulation causes signature verification. The identification of this vulnerability is CVE-2020-2021. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. This vulnerability is considered historic because of its background and reception. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Palo Alto PAN-OS up to 8.0.x/8.1.14/9.0.8/9.1.2 (Firewall Software) and classified as very critical. Affected by this vulnerability is an unknown functionality of the component SAML Authentication. The manipulation with an unknown input leads to a signature verification vulnerability. The CWE definition for the vulnerability is CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.

The weakness was shared 06/29/2020 as PAN-148988 as confirmed security advisory (Website). It is possible to read the advisory at security.paloaltonetworks.com. This vulnerability is known as CVE-2020-2021 since 12/04/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 02/07/2025). Due to its background and reception, this vulnerability has a historic impact.

It is declared as attacked. We expect the 0-day to have been worth approximately $25k-$100k. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 03/25/2022 with a due date of 04/15/2022:

Apply updates per vendor instructions.

Upgrading to version 8.1.15, 9.0.9 or 9.1.3 eliminates this vulnerability. It is possible to mitigate the problem by applying the configuration setting Validate Identity Provider Certificate. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Not Affected

• Palo Alto PAN-OS 7.1.x

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto

Name

• PAN-OS

Version

• 8.0
• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.1.5
• 8.1.6
• 8.1.7
• 8.1.8
• 8.1.9
• 8.1.10
• 8.1.11
• 8.1.12
• 8.1.13
• 8.1.14
• 9.0.0
• 9.0.1
• 9.0.2
• 9.0.3
• 9.0.4
• 9.0.5
• 9.0.6
• 9.0.7
• 9.0.8
• 9.1.0
• 9.1.1
• 9.1.2

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #175: CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication (by fsi_isac)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion