CISA Alerts to Active Exploitation of Critical Palo Alto Networks Vulnerability

CVE-2024-43093 is a privilege escalation flaw in the Android Framework's ExternalStorageProvider (the component behind the system document/file picker), where the shouldHideDocument function mishandles Unicode normalization, allowing crafted file paths to bypass the filter that hides sensitive directories such as app-private storage (CWE-176). It is triggered locally: an app with no additional execution privileges can exploit it with user interaction, for example when a user selects a file or location through the documents UI. A successful bypass grants unauthorized access to otherwise protected directories and can lead to local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.3, vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Any device running the Android Framework is in scope, meaning effectively the entire Android installed base, although the local access and user-interaction requirements limit practical exploitability to targeted scenarios. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07 and Google has indicated it may be under limited, targeted exploitation; no public proof-of-concept is known, and EPSS currently rates the 30-day exploitation probability at a modest 0.7%, though the KEV listing is the authoritative in-the-wild signal.

Do: Apply Google's Android security updates immediately — the fix is included in the November 2024 Android Security Bulletin (security patch level 2024-11-01) or later — and verify the device's security patch level in Settings; OEM devices (e.g., Samsung) may receive the fix through vendor updates on a lag. Per the CISA KEV required action, treat patching as urgent or apply vendor mitigations, and as an interim measure restrict sideloaded/untrusted app installs and caution users when picking files through the document picker. Ransomware linkage is unknown, and the user-interaction requirement means exploitation is targeted rather than wormable.

CyberPanel, a web hosting control panel, contains a missing-authentication flaw (CWE-306) in the upgrademysqlstatus function in databases/views.py that allows remote, unauthenticated attackers to execute arbitrary commands. The panel's secMiddleware only enforces authentication on POST requests, so attackers can reach /dataBases/upgrademysqlstatus without credentials and inject shell metacharacters into the statusfile property, which the application passes to a shell. Successful exploitation yields arbitrary command execution on the server, effectively full control of the hosting panel and the websites it manages; versions through 2.3.6 and unpatched 2.3.7 are affected. Exploitation is active: the PSAUX group used this flaw in October 2024 to deploy ransomware on web hosting servers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-11-07. A public proof-of-concept is available and EPSS places the 30-day exploitation probability at 86.5% (100th percentile).

Do: Upgrade to a patched CyberPanel build that includes fix commit 5b08cd6 (a fully patched 2.3.7 or later release); if you cannot patch immediately, restrict access to /dataBases/upgrademysqlstatus or place the panel behind an access-control layer. Because exploitation is active and ransomware-related (PSAUX), check for compromise: review web/audit logs for unauthenticated requests to /dataBases/upgrademysqlstatus, look for unexpected processes, cron jobs, or ransomware artifacts, and per CISA apply vendor mitigations or discontinue use of the product.

CVE-2024-5910 is a missing authentication flaw (CWE-306) in Palo Alto Networks Expedition, a tool used to migrate, tune, and enrich firewall configurations. An attacker with network access to an Expedition instance can exploit the unauthenticated critical function to take over the Expedition admin account without any credentials. Once in control, the attacker can access configuration secrets, credentials, and other data imported into Expedition, and public research (horizon3.ai) shows it can be chained with other Expedition bugs for full system compromise. Any organization running Expedition — particularly instances reachable from the internet or shared networks — is affected. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07, carries a 91.8% EPSS exploitation probability, and is being exploited alongside related Expedition and firewall bugs (CVE-2024-9463, CVE-2024-9465).

Do: Apply the vendor's patched Expedition release per Palo Alto Networks' advisory; if the tool is no longer needed, decommission or discontinue it, as CISA permits. Until patched, restrict network access to Expedition to trusted management hosts and remove it from internet exposure. Check Expedition logs for signs of unauthorized admin access and rotate any credentials or secrets stored in the tool.