CVE-2024-3400: critical vulnerability in Palo Alto Networks PAN-OS
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert, has a working public exploit and 1 threat group(s) use it.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 06/2024Vulnerabilidade no Sistema Operacional Palo Alto Networks (PAN-OS)read on gov.br ↗
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
A flaw in Palo Alto Networks' GlobalProtect feature allows unauthenticated attackers to create files on the firewall, which can then be used to inject commands and take complete control of the device with root-level access.
An unauthenticated remote attacker can exploit improper input validation (CWE-20) and command injection (CWE-77) in GlobalProtect to create arbitrary files on the firewall, leading to OS command injection with root privileges. Exploitation requires specific PAN-OS versions and feature configurations; Cloud NGFW, Panorama, and Prisma Access are not affected.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.