Palo Alto Networks firewalls under attack, hotfixes incoming! (CVE-2024-3400)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-3400 | Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect Palo Alto Networks PAN-OS contains a command injection flaw (CWE-77, with improper input validation per CWE-20) in its GlobalProtect feature, allowing an unauthenticated attacker to execute arbitrary operating-system commands with root privileges on the affected firewall. The flaw is triggered through the GlobalProtect interface, which in most deployments is reachable from untrusted networks, so no valid user credentials or prior access are required. Successful exploitation yields full root control of the firewall, the most powerful position in a network perimeter, enabling traffic interception, configuration tampering, and use as a foothold for further compromise. All PAN-OS firewalls running affected releases with the GlobalProtect feature are exposed; CISA added the issue to the KEV catalog on 2024-04-12 with ransomware use noted, and EPSS puts the 30-day exploitation probability at 100% (100th percentile). No public proof-of-concept is recorded in the source data, but confirmed in-the-wild exploitation makes patching urgent. Do: Apply the PAN-OS patches released in Palo Alto Networks' bulletin according to its published patch schedule, prioritizing internet-facing firewalls. Until patched, enable the vendor's Threat Prevention signatures as required by CISA KEV, restrict exposure of the GlobalProtect interface to trusted sources where possible, and review logs and device configuration for signs of compromise given confirmed exploitation with known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×2 |
| large≈10,000–100,000 internet-exposed PAN-OS firewalls with GlobalProtect enabled |
Full article451 words · extracted from helpnetsecurity.com · click to collapse
UPDATE: April 30, 09:30 AM ET
New story:
Palo Alto firewalls: CVE-2024-3400 exploitation and PoCs for persistence after resets/upgrades
UPDATE: April 17, 05:50 AM ET
New story:
Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation
UPDATE (April 12, 2024, 03:10 p.m. ET):
New story: CVE-2024-3400 exploited: Unit 42, Volexity share more details about the attacks
Attackers are exploiting a command injection vulnerability (CVE-2024-3400) affecting Palo Alto Networks’ firewalls, the company has warned, and urged customers to implement temporary mitigations and get in touch to check whether their devices have been compromised.
“Palo Alto Networks is aware of a limited number of attacks that leverage the exploitation of this vulnerability,” they said, and thanked Volexity researchers for flagging the issue.
Exploitation of the vulnerability can be automated.
About CVE-2024-3400
CVE-2024-3400 is a command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software and may allow an unauthenticated attacker to execute arbitrary code with root privileges on vulnerable firewalls.
The vulnerability affects PAN-OS versions 11.1, 11.0 and 10.2 that have configurations for both GlobalProtect gateway and device telemetry enabled. It will be fixed with hotfixes 11.1.2-h3, 11.0.4-h1, and 10.2.9-h1, which are scheduled to be released on April 14, 2023 (Sunday).
“You can verify whether you have a GlobalProtect gateway configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways) and verify whether you have device telemetry enabled by checking your firewall web interface (Device > Setup > Telemetry),” Palo Alto Networks explained.
“Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 95187 (introduced in Applications and Threats content version 8833-8682).”
They should also apply a vulnerability protection security profile to the GlobalProtect interface to prevent exploitation of this issue on their device.
If they can’t do any of that, they can mitigate the impact of this vulnerability by temporarily disabling device telemetry (and then re-enable it once the hotfix is applied).
“Customers are able to open a case in the Customer Support Portal (CSP) and upload a technical support file (TSF) to determine if their device logs match known indicators of compromise (IoC) for this vulnerability,” the company added.
UPDATE (April 12, 2024, 09:25 a.m. ET):
“We have seen limited exploitation but impact at multiple customers,” Volexity president Steven Adair commented on Twitter.
“We first detected this just two days ago. Impressive response from the Palo Alto Networks team, as they quickly worked with us and have now pushed a Threat Protection signature with a fix to come April 14.”
UPDATE (April 15, 2024, 04:10 a.m. ET):
Some PAN-OS fixes are now available and others will be published in the coming days.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/04/12/cve-2024-3400/