Palo Alto PAN-OS GlobalProtect command injection

What it does

An arbitrary file creation vulnerability in the GlobalProtect feature of PAN-OS lets an unauthenticated attacker write a file with a controlled name, which is then interpreted by a cron job as shell input. The result is command execution as root on the firewall.

Exploitation in the wild began before public disclosure (tracked as Operation MidnightEclipse). Observed payloads deploy a Python backdoor and pivot into the internal network using the firewall's own trust position.

Devices with GlobalProtect gateway or portal enabled are affected. Device telemetry does not need to be enabled for exploitation to succeed.

Remediation

1. Upgrade to PAN-OS 10.2.9-h1, 11.0.4-h1, 11.1.2-h3 or later hotfixes.
2. Apply Threat Prevention signature IDs 95187, 95189 and 95191 if a Threat Prevention subscription is active.
3. Review the device for indicators of compromise: unexpected cron entries, files under /var/appweb/sslvpndocs/global-protect/, and outbound connections from the management plane.
4. Rotate all credentials and certificates stored on a device that shows signs of exploitation.

Enumeration

Detection templates and scanners you can run to find exposed instances on your own attack surface.

$ nuclei -id CVE-2024-3400 -u https://TARGET

Exploitation

Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.

$ msfconsole -q -x "use exploit/linux/http/panos_telemetry_cmd_exec; show options"

$ git clone https://github.com/watchtowrlabs/palo-alto-panos-cve-2024-3400.git

References

• Palo Alto Networks advisorysecurity.paloaltonetworks.com
• CISA KEV entrywww.cisa.gov
• NVD recordnvd.nist.gov
• Volexity analysiswww.volexity.com