More bugs in Palo Alto Expedition see active exploitation, CISA warns

CVE-2024-5910 is a missing authentication flaw (CWE-306) in Palo Alto Networks Expedition, a tool used to migrate, tune, and enrich firewall configurations. An attacker with network access to an Expedition instance can exploit the unauthenticated critical function to take over the Expedition admin account without any credentials. Once in control, the attacker can access configuration secrets, credentials, and other data imported into Expedition, and public research (horizon3.ai) shows it can be chained with other Expedition bugs for full system compromise. Any organization running Expedition — particularly instances reachable from the internet or shared networks — is affected. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07, carries a 91.8% EPSS exploitation probability, and is being exploited alongside related Expedition and firewall bugs (CVE-2024-9463, CVE-2024-9465).

Do: Apply the vendor's patched Expedition release per Palo Alto Networks' advisory; if the tool is no longer needed, decommission or discontinue it, as CISA permits. Until patched, restrict network access to Expedition to trusted management hosts and remove it from internet exposure. Check Expedition logs for signs of unauthorized admin access and rotate any credentials or secrets stored in the tool.

CVE-2024-9463 is a critical (CVSS 4.0: 9.9) OS command injection flaw (CWE-78) in Palo Alto Networks Expedition, the vendor's on-premises migration and firewall-management tool. An unauthenticated, network-adjacent attacker can send crafted input to trigger arbitrary operating system command execution with root privileges, requiring no credentials or user interaction. A successful compromise exposes the sensitive data Expedition holds for managed PAN-OS firewalls, including usernames, cleartext passwords, device configurations, and device API keys, which can enable follow-on attacks against the firewalls themselves. Any organization running an Expedition deployment, typically as a management appliance that is sometimes reachable from the internet, is affected. Exploitation is confirmed in the wild: Palo Alto Networks confirmed active exploitation (reported alongside SQL injection flaw CVE-2024-9465), CISA added it to the Known Exploited Vulnerabilities catalog on 2024-11-14, and EPSS assigns a 98.5% probability of exploitation within 30 days.

Do: Upgrade Expedition to the vendor-fixed release per Palo Alto Networks' advisory, and remove or restrict internet exposure of the Expedition web interface; if patching is not immediately possible, CISA's required action is to apply vendor mitigations or discontinue use of the product. Because exploitation can disclose cleartext firewall usernames, passwords, and API keys, rotate those credentials and review firewall configurations and Expedition logs for signs of compromise, particularly given confirmed active exploitation alongside CVE-2024-9465.

CVE-2024-9464 is an OS command injection flaw (CWE-78) in Palo Alto Networks Expedition, the vendor's firewall migration and management tool, that lets an authenticated attacker inject and run arbitrary operating system commands with root privileges on the Expedition host. It is triggered over the network (AV:N) with only low privileges required, meaning any valid, authenticated Expedition session with crafted input, and it requires no user interaction or special conditions. Successful exploitation exposes the sensitive data Expedition stores during migrations, including usernames, cleartext passwords, device configurations, and API keys of managed PAN-OS firewalls. Any organization running Expedition is affected, typically those using the tool to migrate firewalls from other vendors to PAN-OS or to consolidate Panorama deployments. Palo Alto Networks and CISA have warned of active exploitation of Expedition vulnerabilities from this disclosure (CVE-2024-5910, CVE-2024-9463, CVE-2024-9465), related reporting indicates CISA has added the Expedition bugs to its Known Exploited Vulnerabilities catalog, and a very high EPSS score (82.6%, 100th percentile) indicates this flaw is highly likely to be exploited within 30 days.

Do: Update Expedition to the latest software/content release available from Palo Alto Networks per its advisory (no fixed version is specified in the source data), and restrict the Expedition web interface to trusted management networks or VPN-only access. Because Expedition stores PAN-OS firewall credentials, configurations, and API keys — potentially in cleartext — rotate those credentials and API keys and review Expedition logs for unexpected authenticated activity.