.svg)
.svg)
The Blue Report 2024
Get a comprehensive analysis of over 136 million cyber attacks and understand the state of threat exposure management.
On April 12th, 2024, Palo Alto Networks disclosed a critical vulnerability affecting PAN-OS software used in security appliances like their next-generation firewalls [1]. CVE-2024-3400 is a command injection vulnerability with a CVSS score of 10.0 (Critical). The vulnerability allows adversaries to execute commands in Palo Alto firewalls with root privileges remotely. Considering its potential impact, organizations are advised to patch their vulnerable PAN-OS software as soon as possible.
In this blog, we explained how the Palo Alto PAN-OS CVE-2024-3400 vulnerability works and how organizations can defend against CVE-2024-3400 attacks.
Palo Alto PAN-OS CVE-2024-3400 Vulnerability Explained
Palo Alto Networks Operating System (PAN-OS) is used as the foundational software platform for Palo Alto Networks' next-generation firewalls and other security appliances. On April 12th, 2024, Palo Alto released a security advisory about a command injection vulnerability affecting PAN-OS software. CVE-2024-3400 has a CVSS score of 10.0 (Critical) and can be exploited for unauthenticated remote code execution with root privileges in vulnerable PAN-OS versions. Since PAN-OS is used in many Palo Alto Firewall appliances, adversaries may abuse the CVE-2024-3400 vulnerability for initial access, persistence, data exfiltration, or lateral movement.
CVE-2024-3400 vulnerability affects the products below, and organizations are advised to patch their vulnerable PAN-OS software without delay.
|
Product Name |
Affected Versions |
Fixed Versions |
|
PAN-OS 11.1 |
11.1.0-h3 or below 11.1.1-h1 or below 11.1.2-h3 or below |
11.1.0-h3 or later 11.1.1-h1 or later 11.1.2-h3 or later |
|
PAN-OS 11.0 |
11.0.2-h4 or below 11.0.3-h10 or below 11.0.4-h1 or below |
11.0.2-h4 or later 11.0.3-h10 or later 11.0.4-h1 or later |
|
PAN-OS 10.2 |
10.2.5-h6 or below 10.2.6-h3 or below 10.2.7-h8 or below 10.2.8-h3 or below 10.2.9-h1 or below |
10.2.5-h6 or later 10.2.6-h3 or later 10.2.7-h8 or later 10.2.8-h3 or later 10.2.9-h1 or later |
How Palo Alto CVE-2024-3400 Exploit Works?
CVE-2024-3400 is a command injection vulnerability found in the GlobalProtect feature of PAN-OS software. The telemetry functionality in the GlobalProtect uses the curl command to send logs from a temporary directory. Using malformed SESSID, adversaries were able to inject shell commands with root privileges via unauthenticated HTTP post requests.
The example HTTP POST request below exploits the CVE-2024-3400 vulnerability. Note the curl{$IFS}example.com at the end of the SESSID.
|
POST/ssl-vpn/hipreport.esp HTTP/1.1 |
Volexity discovered the use of CVE-2024-3400 vulnerability in the wild by a threat actor tracked as UTA0218 [2]. Adversaries exploited the vulnerability to deploy a python-based backdoor named UPSTYLE for persistent access to target organizations.
|
Malware Name |
MD5 |
SHA1 |
SHA256 |
|
UPSTYLE Backdoor |
0c1554888ce9ed0da1583dbdf7b31651 |
988fc0d23e6e30c2c46ccec9bbff50b7453b8ba9 |
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac |
How does Picus Help Simulate Palo Alto PAN-OS CVE-2024-3400 Attacks?
We also strongly suggest simulating the Palo Alto PAN-OS CVE-2024-3400 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Complete Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as Log4Shell, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for Palo Alto PAN-OS CVE-2024-3400 vulnerability exploitation attacks:
|
Threat ID |
Threat Name |
Attack Module |
|
39549 |
Palo Alto Networks Web Attack Campaign |
Web Application |
|
50903 |
UPSTYLE Backdoor Malware Download Threat |
Network Infiltration |
|
35140 |
UPSTYLE Backdoor Malware Email Threat |
E-mail Infiltration (Phishing) |
Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address Palo Alto PAN-OS CVE-2024-3400 vulnerability in preventive security controls. Currently, Picus Labs validated the following signatures for Palo Alto PAN-OS CVE-2024-3400 vulnerability:
|
Security Control |
Signature ID |
Signature Name |
|
Check Point NGFW |
Web Servers Malicious HTTP Header Directory Traversal |
asm_dynamic_prop_DIR_TRAV_HEADERS |
|
F5 BIG-IP |
Directory Traversal attempt (Content) |
200101550 |
|
Forcepoint NGFW |
HTTP_CSH-Directory-Traversal-In-Session-Id-Cookie |
|
|
Forcepoint NGFW |
HTTP_CSH-Directory-Traversal-In-Cookie-Header |
|
|
Fortigate IPS |
HTTP.Unix.Shell.IFS.Remote.Code.Execution |
45677 |
|
FortiWeb |
Generic Attacks(Extended) |
060150002 |
|
FortiWeb |
Generic Attacks(Extended) |
060010001 |
|
Imperva SecureSphere |
Directory Traversal (In Cookies/Parameters Value) |
|
|
Imperva SecureSphere |
Directory Traversal - 40 |
|
|
Imperva SecureSphere |
Directory Traversal - 555501307 |
|
|
Imperva SecureSphere |
Directory Traversal - 37 |
|
|
ModSecurity |
Path Traversal Attack (/../) |
930100 |
|
ModSecurity |
Remote Command Execution: Unix Command Injection |
932100 |
|
ModSecurity |
Remote Command Execution: Unix Shell Expression Found |
932130 |
|
ModSecurity |
Remote Command Execution: Unix Shell Code Found |
932160 |
|
PaloAlto IPS |
Palo Alto Networks GlobalProtect OS Command Injection Vulnerability |
95187 |
|
Snort |
SERVER-WEBAPP Palo Alto Networks Firewall directory traversal attempt |
1.63309.1 |
|
TippingPointTPS |
HTTP: Palo Alto Networks PAN-OS GlobalProtect Command Injection Vulnerability |
44125 |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Complete Security Validation Platform.
References
[1] P. Psirt, “CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect,” Palo Alto Networks Product Security Assurance, Apr. 12, 2024. Available: https://security.paloaltonetworks.com/CVE-2024-3400. [Accessed: Apr. 17, 2024]
[2] Volexity, “Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400),” Volexity, Apr. 12, 2024. Available: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/. [Accessed: Apr. 17, 2024]
