Critical Palo Alto Networks Expedition bug exploited (CVE-2024-5910)

CVE-2024-5910 is a missing authentication flaw (CWE-306) in Palo Alto Networks Expedition, a tool used to migrate, tune, and enrich firewall configurations. An attacker with network access to an Expedition instance can exploit the unauthenticated critical function to take over the Expedition admin account without any credentials. Once in control, the attacker can access configuration secrets, credentials, and other data imported into Expedition, and public research (horizon3.ai) shows it can be chained with other Expedition bugs for full system compromise. Any organization running Expedition — particularly instances reachable from the internet or shared networks — is affected. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07, carries a 91.8% EPSS exploitation probability, and is being exploited alongside related Expedition and firewall bugs (CVE-2024-9463, CVE-2024-9465).

Do: Apply the vendor's patched Expedition release per Palo Alto Networks' advisory; if the tool is no longer needed, decommission or discontinue it, as CISA permits. Until patched, restrict network access to Expedition to trusted management hosts and remove it from internet exposure. Check Expedition logs for signs of unauthorized admin access and rotate any credentials or secrets stored in the tool.

CVE-2024-9464 is an OS command injection flaw (CWE-78) in Palo Alto Networks Expedition, the vendor's firewall migration and management tool, that lets an authenticated attacker inject and run arbitrary operating system commands with root privileges on the Expedition host. It is triggered over the network (AV:N) with only low privileges required, meaning any valid, authenticated Expedition session with crafted input, and it requires no user interaction or special conditions. Successful exploitation exposes the sensitive data Expedition stores during migrations, including usernames, cleartext passwords, device configurations, and API keys of managed PAN-OS firewalls. Any organization running Expedition is affected, typically those using the tool to migrate firewalls from other vendors to PAN-OS or to consolidate Panorama deployments. Palo Alto Networks and CISA have warned of active exploitation of Expedition vulnerabilities from this disclosure (CVE-2024-5910, CVE-2024-9463, CVE-2024-9465), related reporting indicates CISA has added the Expedition bugs to its Known Exploited Vulnerabilities catalog, and a very high EPSS score (82.6%, 100th percentile) indicates this flaw is highly likely to be exploited within 30 days.

Do: Update Expedition to the latest software/content release available from Palo Alto Networks per its advisory (no fixed version is specified in the source data), and restrict the Expedition web interface to trusted management networks or VPN-only access. Because Expedition stores PAN-OS firewall credentials, configurations, and API keys — potentially in cleartext — rotate those credentials and API keys and review Expedition logs for unexpected authenticated activity.

Palo Alto Networks Expedition contains an unauthenticated SQL injection flaw (CWE-89, CVSS 4.0 score 9.2) that an attacker can trigger over the network by sending crafted requests to the Expedition web application without any credentials. Successful exploitation reveals the contents of the Expedition database, including password hashes, usernames, device configurations, and device API keys, and additionally allows the attacker to create and read arbitrary files on the Expedition system. Anyone running Expedition — a migration and configuration-conversion tool typically deployed on-premises by organizations migrating to or managing Palo Alto Networks firewalls — is affected, while the firewalls themselves are not the direct target of this flaw. Palo Alto Networks has confirmed active exploitation, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-11-14, and EPSS assigns a 99.6% probability of exploitation within 30 days; public research also demonstrates it can be chained with other Expedition bugs for a full system compromise.

Do: Upgrade Expedition to the patched release per Palo Alto Networks' security advisory, and restrict or remove internet exposure since the tool is not intended to be public-facing. Given confirmed in-the-wild exploitation, review Expedition logs for anomalous requests, rotate potentially harvested secrets such as device API keys, Expedition account credentials, and password hashes, and discontinue use of the product if mitigations cannot be applied. Also verify whether downstream firewall configurations were altered, since device configurations were accessible through the database.