CVE-2024-3400

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 10.2 through 11.1

Description A command injection issue exists in the GlobalProtect feature of Palo Alto Networks PAN-OS software, occurring as a result of arbitrary file creation. This flaw allows an unauthenticated remote attacker to execute arbitrary code with root privileges on the firewall. The exploitation chain involves a path traversal vulnerability via the SESSID cookie, enabling the attacker to write files to the /opt/panlogs/tmp/device telemetry/ directory. Subsequently, a command injection occurs within the pansys.py library, which uses the subprocess.Popen() function to execute curl commands for sending telemetry via cron. Attackers may use the ${IFS} (Internal Field Separator) variable to bypass space restrictions in commands. Real-world exploitation has been observed in targeted APT attacks known as Operation MidnightEclipse (or UTA0218), where attackers deployed a Python-based backdoor named UPSTYLE, stole configuration data, and performed lateral movement using SMB and WinRM. It is estimated that between 40,000 and 133,000 devices worldwide may be potentially affected. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted.

Recommendations Update PAN-OS versions 10.2, 11.0, and 11.1 to the latest patched versions. As a temporary mitigation, disable the GlobalProtect feature or device telemetry if not required.