Critical RCE in Palo Alto Networks (PAN) firewalls revealed, patch ASAP! (CVE-2021-3064)

The existence of a critical RCE vulnerability (CVE-2021-3064) affecting certain versions of Palo Alto Networks (PAN) firewalls using the GlobalProtect Portal VPN has been revealed by a cybersecurity company that exploited it during red team engagements for the last 12 months.

The vulnerability has been patched, but since there are still over 10,000 vulnerable internet-facing installations out there, Randori (the aforementioned cybersecurity company) will refrain from publishing technical details related to the vulnerability for a month, to give affected organizations enough time to patch.

About CVE-2021-3064

“CVE-2021-3064 is a buffer overflow that occurs while parsing user-supplied input into a fixed-length location on the stack. The problematic code is not reachable externally without utilizing an HTTP smuggling technique. Exploitation of these together yields remote code execution under the privileges of the affected component on the firewall device,” the Randori Attack Team explained.

“In order to exploit this vulnerability, an attacker must have network access to the device on the GlobalProtect service port (default port 443). As the affected product is a VPN portal, this port is often accessible over the Internet. On devices with ASLR enabled (which appears to be the case in most hardware devices), exploitation is difficult but possible. On virtualized devices (VM-series firewalls), exploitation is significantly easier due to lack of ASLR and Randori expects public exploits will surface.”

Palo Alto Networks confirmed that the vulnerability impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17, and only PAN-OS firewall configurations with a GlobalProtect portal or gateway enabled.

The company said that they haven’t seen evidence of this bug being or having been exploited in the wild, and they also noted that, “Due to the nature of the vulnerability, there is no reliable indicator of compromise.”

Mitigation

Administrators are urged to implement the offered updates or upgrade to a later PAN-OS version that is not affected.

If that’s not immediately possible, they can mitigate the risk of exploitation either by:

• Disabling the GlobalProtect portal or gateway (if they are not using the VPN capability), or
• Enabling threat prevention signatures for Unique Threat IDs 91820 and 91855 on traffic destined for GlobalProtect portal and gateway interfaces to block attacks against CVE-2021-3064.