CVE-2024 — What You Need

Unpacking CVE-2024 reveals a critical command injection vulnerability impacting Palo Alto Networks PAN-OS GlobalProtect gateways. This flaw, tracked as CVE-2024-3400, carries a CVSSv3.1 base score of 10.0, indicating maximum severity. It permits an unauthenticated attacker to execute arbitrary code with root privileges on the firewall device. The vulnerability affects specific PAN-OS versions when the GlobalProtect gateway and device telemetry features are enabled.

The affected PAN-OS versions include 10.2 (prior to 10.2.9-h1), 11.0 (prior to 11.0.4-h1), and 11.1 (prior to 11.1.2-h3). Cloud-managed instances of PAN-OS 10.2, 11.0, and 11.1 are also vulnerable. This zero-day vulnerability became publicly known after active exploitation was detected in the wild. Palo Alto Networks released an emergency advisory, PAN-SA-2024-0005, detailing the issue and providing remediation guidance.

Unpacking CVE-2024: Technical Root Cause Analysis

CVE-2024-3400 stems from an improper input validation flaw within the GlobalProtect gateway component. Specifically, the vulnerability resides in how the device processes HTTP requests related to device telemetry. When device telemetry is active, the system collects and transmits operational data to Palo Alto Networks for analysis. An attacker can manipulate certain parameters within these HTTP requests, injecting malicious commands.

The core issue is a command injection vulnerability. This class of vulnerability occurs when an application constructs a system command using external input without properly sanitizing or validating that input. The attacker's crafted input becomes part of the command executed by the operating system, allowing them to run arbitrary shell commands. In the case of CVE-2024-3400, the injected commands execute with root privileges due to the context in which the vulnerable process operates.

The vulnerability appears to specifically target the telemetry collection mechanism. Attackers exploit a weakness in a file write operation that occurs before command execution. By manipulating variables passed to a system function, they can achieve arbitrary file creation. This file then contains specially crafted data that, when later processed by a separate, vulnerable component, triggers command execution. The exploit chain involves writing a malicious file to a specific location and then causing the system to execute it through a subsequent request or internal process.

Research indicates the initial exploitation vector involves an HTTP request to a specific URI path associated with the GlobalProtect gateway. This request includes parameters that the vulnerable function processes. The lack of robust input sanitization allows an attacker to break out of the intended data structure and insert shell metacharacters or command delimiters, thereby appending arbitrary commands to the intended system call. The process then executes the entire malformed command string, including the attacker's payload.

Exploitation Mechanics

Exploitation of CVE-2024-3400 is unauthenticated and network-based. An attacker sends a specially crafted HTTP request to a vulnerable GlobalProtect gateway. This request targets a specific URI path, typically within the /sslmgr/ or /global-protect/ context, which handles telemetry data. The request body or specific headers contain the malicious payload.

The payload leverages command injection techniques. Attackers embed shell commands within parameters that the server expects to be benign data. For example, if a parameter is processed by a function like system(sprintf("echo %s >> /tmp/log", user_input)), an attacker could supply user_input="hello; id > /tmp/id_output;". This would result in the command echo hello; id > /tmp/id_output; >> /tmp/log being executed, running the id command on the system.

The initial exploit observed in the wild involved creating a backdoor. Attackers wrote a malicious file, such as a web shell or a cron job entry, to a persistent location on the firewall. This file then provided continued access to the compromised device. For instance, a common technique involves writing a cron job that periodically fetches and executes a script from an attacker-controlled server, ensuring persistence even if the initial backdoor is removed.

The specific HTTP request structure for exploitation involves POST requests with particular content types and data encoding. While the exact payload details remain restricted under responsible disclosure, the pattern involves manipulating specific variables that control file paths or command arguments. This manipulation allows for the injection of shell metacharacters like semicolons (;), backticks (`), or command substitution syntax ($(command)) to execute arbitrary commands.

Successful exploitation results in root-level command execution. This allows attackers to perform various actions:

• Install backdoors or persistent access mechanisms.
• Exfiltrate sensitive configuration data or network traffic.
• Pivot to internal networks.
• Modify firewall rules to facilitate further attacks.
• Disable security features or loggings.

The unauthenticated nature makes this vulnerability highly appealing to attackers, as it requires no prior access or credentials.

Detection: How to Check if You're Affected

Detecting compromise or vulnerability to CVE-2024-3400 requires a multi-faceted approach, focusing on version checks, configuration audits, and network traffic analysis.

Version and Configuration Checks

First, identify all Palo Alto Networks firewalls running PAN-OS. Check their versions against the vulnerable ranges:

• PAN-OS 10.2: All versions before 10.2.9-h1
• PAN-OS 11.0: All versions before 11.0.4-h1
• PAN-OS 11.1: All versions before 11.1.2-h3

If your device runs a vulnerable version, confirm if the GlobalProtect gateway is enabled. Also, check if device telemetry is active. The vulnerability specifically requires both features to be enabled for exploitation.

# Example command to check PAN-OS version via CLI
show system info | match sw-version

# Example command to check GlobalProtect gateway status
show global-protect-gateway status

# Example command to check device telemetry status
show device-telemetry status

Network and Endpoint Monitoring

Monitor network traffic for suspicious requests targeting your GlobalProtect gateway. Look for unusual POST requests to telemetry-related URIs. Specific indicators of compromise (IoCs) include:

• Requests to /sslmgr/ or /global-protect/ paths with unusual parameters or large, encoded payloads.
• Outbound connections from the firewall to unknown IP addresses or domains.
• Unexpected file creations or modifications on the firewall's filesystem, particularly in temporary directories or cron job locations.
• Unusual process activity or command execution events logged on the firewall itself.

Security Information and Event Management (SIEM) systems should ingest firewall logs. Create alerts for:

• Failed login attempts followed by suspicious requests.
• High volume of requests to telemetry endpoints from unusual source IPs.
• Any alerts generated by Palo Alto Networks Threat Prevention signatures related to CVE-2024-3400.

Secably Tools for Initial Assessment

You can use Secably's free port scanner to identify if your GlobalProtect gateway is exposed to the internet on standard ports (e.g., 443 TCP). This confirms the attack surface. Our free website vulnerability scanner can perform basic checks for web server anomalies, though deep vulnerability scanning for this specific flaw typically requires authenticated access or specialized tools.

For broader attack surface visibility, consider external scanning services like Zondex, which can identify exposed Palo Alto Networks devices across the internet. Regularly checking your external posture helps identify unintentional exposures. Secably also offers paid monitoring plans starting at $19/month for continuous asset and vulnerability monitoring, which can help detect new exposures or configuration drifts over time.

Remediation Steps

Immediate action is necessary to mitigate CVE-2024-3400. Palo Alto Networks has released hotfixes addressing the vulnerability.

Apply Hotfixes

The primary remediation is to upgrade PAN-OS to a patched version. Apply the hotfix appropriate for your PAN-OS branch:

• PAN-OS 10.2: Upgrade to 10.2.9-h1 or later
• PAN-OS 11.0: Upgrade to 11.0.4-h1 or later
• PAN-OS 11.1: Upgrade to 11.1.2-h3 or later

Palo Alto Networks advises applying these hotfixes as quickly as possible. These updates address the input validation flaw, preventing command injection.

Temporary Workarounds

If immediate patching is not possible, consider these temporary mitigation steps:

1. Disable Device Telemetry: Disabling device telemetry on the GlobalProtect gateway temporarily removes the vulnerable code path. This is a critical step if you cannot patch immediately. Be aware this affects the collection of diagnostic data.
2. Apply Threat Prevention Signatures: Palo Alto Networks released Threat Prevention signatures (Threat ID 95191, 95192, 95193, 95194) to detect and block exploitation attempts. Ensure your Threat Prevention content is up-to-date and applied with an "action: reset-both" or "action: drop" rule for these signatures.
3. Restrict Access: Limit access to the GlobalProtect gateway from untrusted networks. While this vulnerability is unauthenticated, reducing exposure surface helps.

These workarounds are temporary. Prioritize applying the official hotfixes. For more details on other critical vulnerabilities and their fixes, refer to our blog post on How Deep Dive into BlueMoon Works and What You Should Patch.

Post-Compromise Actions

If you suspect compromise, perform a thorough incident response:

• Forensic Analysis: Collect logs, memory dumps, and disk images for analysis. Look for unusual processes, modified files, or outbound connections.
• Credential Rotation: Assume all credentials managed by or accessible from the firewall are compromised. Rotate all administrative passwords, API keys, and other secrets.
• Network Segmentation: Isolate the compromised firewall to prevent lateral movement.
• Restore from Clean Backup: If possible, restore the firewall configuration from a known good backup taken before the compromise.

Timeline of Disclosure

The timeline for CVE-2024-3400 highlights the rapid response required for zero-day vulnerabilities:

• April 10, 2024: Volexity identifies active exploitation of a zero-day vulnerability in Palo Alto Networks PAN-OS. They notify Palo Alto Networks.
• April 12, 2024: Palo Alto Networks publicly acknowledges the vulnerability (PAN-SA-2024-0005) and confirms active exploitation. They provide initial mitigation advice, including disabling device telemetry.
• April 14-16, 2024: Palo Alto Networks releases the first hotfixes for affected PAN-OS versions. This includes 10.2.9-h1, 11.0.4-h1, and 11.1.2-h3.
• April 19, 2024: CISA issues an emergency directive (ED 24-02) urging federal agencies to patch or implement mitigations by April 19, 2024, citing widespread exploitation.
• Ongoing: Continued monitoring for new exploitation techniques and further patches for additional versions.

This rapid disclosure and patching cycle underscores the critical nature of CVE-2024-3400. Organizations must maintain vigilance and prioritize security updates to protect against such high-impact threats.