Palo Alto PAN-OS Policy Enforcement Handshake input validation

Summaryinfo

A vulnerability was found in Palo Alto PAN-OS. It has been declared as critical. The affected element is an unknown function of the component Policy Enforcement. Such manipulation as part of Handshake leads to input validation. This vulnerability is traded as CVE-2020-2035. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Palo Alto PAN-OS (Firewall Software) (version now known). It has been rated as critical. Affected by this issue is some unknown processing of the component Policy Enforcement. The manipulation as part of a Handshake leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication (SNI) field within the TLS Client Hello handshake. This allows a compromised host in a protected network to evade any security policy that uses URL filtering on a firewall configured with SSL Decryption in the Forward Proxy mode. A malicious actor can then use this technique to evade detection of communication on the TLS handshake phase between a compromised host and a remote malicious server. This technique does not increase the risk of a host being compromised in the network. It does not impact the confidentiality or availability of a firewall. This is considered to have a low impact on the integrity of the firewall because the firewall fails to enforce a policy on certain traffic that should have been blocked. This issue does not impact the URL filtering policy enforcement on clear text or encrypted web transactions. This technique can be used only after a malicious actor has compromised a host in the protected network and the TLS/SSL Decryption feature is enabled for the traffic that the attacker controls. Palo Alto Networks is not aware of any malware that uses this technique to exfiltrate data. This issue is applicable to all current versions of PAN-OS.

The weakness was shared 08/12/2020 (Website). The advisory is shared for download at security.paloaltonetworks.com. This vulnerability is handled as CVE-2020-2035 since 12/04/2019. The exploitation is known to be difficult. The attack may be launched remotely. Additional levels of successful authentication are needed for exploitation. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto

Name

• PAN-OS

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion