CVE-2022-0028

CVE-2022-0028 is a reflected amplification denial-of-service (RDoS) flaw in Palo Alto Networks PAN-OS that lets a network-based attacker bounce amplified TCP traffic off vulnerable PA-Series, VM-Series, and CN-Series firewalls toward a target of the attacker's choosing. It is triggered when a URL filtering profile with one or more blocked categories is assigned to a source zone that contains an external-facing interface, a configuration the vendor describes as atypical and likely unintended. The attacker gains a denial-of-service vector that obscures their identity and implicates the firewall as the source of the attack, though the firewall's own confidentiality, integrity, and availability are not impacted. Affected organizations are those running PAN-OS firewalls with this URL filtering configuration on an internet-facing zone, while Panorama M-Series and virtual Panorama appliances are unaffected and Cloud NGFW and Prisma Access customers are already fixed. The issue is actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on August 22, 2022, and news reports tie it to a DDoS attack on a service provider.

What to do: Apply the PAN-OS updates released by the week of August 15, 2022 per Palo Alto Networks' advisory for CVE-2022-0028. As an interim mitigation, audit URL filtering profiles and remove or reconfigure any profile with blocked categories assigned to a source zone that has an external-facing interface. Because this is a CISA KEV entry being actively exploited, affected organizations must patch per vendor instructions, while Cloud NGFW and Prisma Access customers require no action.