CVE-2024-9465

Palo Alto Networks Expedition contains an unauthenticated SQL injection flaw (CWE-89, CVSS 4.0 score 9.2) that an attacker can trigger over the network by sending crafted requests to the Expedition web application without any credentials. Successful exploitation reveals the contents of the Expedition database, including password hashes, usernames, device configurations, and device API keys, and additionally allows the attacker to create and read arbitrary files on the Expedition system. Anyone running Expedition — a migration and configuration-conversion tool typically deployed on-premises by organizations migrating to or managing Palo Alto Networks firewalls — is affected, while the firewalls themselves are not the direct target of this flaw. Palo Alto Networks has confirmed active exploitation, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-11-14, and EPSS assigns a 99.6% probability of exploitation within 30 days; public research also demonstrates it can be chained with other Expedition bugs for a full system compromise.

What to do: Upgrade Expedition to the patched release per Palo Alto Networks' security advisory, and restrict or remove internet exposure since the tool is not intended to be public-facing. Given confirmed in-the-wild exploitation, review Expedition logs for anomalous requests, rotate potentially harvested secrets such as device API keys, Expedition account credentials, and password hashes, and discontinue use of the product if mitigations cannot be applied. Also verify whether downstream firewall configurations were altered, since device configurations were accessible through the database.