Enrique Castillo

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Expedition (affected versions not specified) Description: The issue is related to an SQL injection vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. The estimated number of potentially affected devices worldwide is not specified. However, there are reports of real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable SQL injection endpoint to minimize the risk of exploitation. Avoid using vulnerable parameters or variables in the affected API endpoint until the issue is resolved. Additionally, monitor the system for any suspicious activity and consider implementing additional security measures to prevent exploitation.

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition. This results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. The vulnerability is related to the failure to neutralize special elements used in the OS command.

A reflected XSS issue in Palo Alto Networks Expedition allows the execution of malicious JavaScript in the context of an authenticated user's browser if they click on a malicious link. This enables phishing attacks that could lead to browser session theft. The vulnerability is related to the lack of protection of the web page structure, which can be exploited by a remote attacker to conduct cross-site scripting attacks by executing arbitrary JavaScript code and redirecting the user to an arbitrary URL.

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition. This results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. The vulnerability is actively exploited and may allow an attacker to elevate privileges and execute commands in the underlying operating system as a root user, potentially exposing encrypted user credentials.

The issue is related to improper input validation in the PAN-OS software, which allows an attacker to manipulate the physical file system and elevate privileges. This can be exploited by an attacker to gain higher privileges.

The issue is related to insufficient input validation in the firmware of the affected devices. It allows an unauthenticated GET request to trigger a reboot, potentially leading to a denial of service.