Palo Alto Networks PAN-OS up to 10.2.9/11.0.4/11.1.2-h2 GlobalProtect command injection

Summaryinfo

A vulnerability marked as critical has been reported in Palo Alto Networks PAN-OS up to 10.2.9/11.0.4/11.1.2-h2. Affected by this issue is some unknown functionality of the component GlobalProtect. Performing a manipulation results in command injection. This vulnerability is identified as CVE-2024-3400. The attack can be initiated remotely. Additionally, an exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Palo Alto Networks PAN-OS up to 10.2.9/11.0.4/11.1.2-h2. This affects an unknown code of the component GlobalProtect. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Fixes for PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 are in development and are expected to be released by April 14, 2024. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. All other versions of PAN-OS are also not impacted.

The advisory is shared at security.paloaltonetworks.com. This vulnerability is uniquely identified as CVE-2024-3400 since 04/05/2024. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

A public exploit has been developed in HTTP GET Request. The exploit is shared for download at twitter.com. It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 04/12/2024 with a due date of 04/19/2024:

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release s

Applying the patch 10.2.9-h1/11.0.4-h1/11.1.2-h3 is able to eliminate this problem. It is possible to mitigate the problem by applying the configuration setting Disable device telemetry. The best possible mitigation is suggested to be patching the affected component.

The vulnerability is also documented in the databases at Exploit-DB (51996), 0day.today (39564) and Zero-Day.cz (876). Further details are available at volexity.com. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto Networks

Name

• PAN-OS

Version

• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4
• 10.2.5
• 10.2.6
• 10.2.7
• 10.2.8
• 10.2.9
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.1.2-h1
• 11.1.2-h2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion