PAN-OS Management Interface Pre-Auth RCE Chain
- Product
- Palo Alto Networks PAN-OS management web interface
- CVE
- CVE-2017-15944
- Disclosed
- 2017-12-11
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- PAN-OS 6.1.18 and earlier, 7.0.18 and earlier, 7.1.13 and earlier, 8.0.5 and earlier.
- Fixed
- 6.1.19, 7.0.19, 7.1.14, 8.0.6.
Summary
Philip Pettersson chained three bugs in the PAN-OS management interface into unauthenticated root code execution. A Metasploit module followed and CISA later added it to KEV based on exploitation.
Root cause
An authentication bypass let an unauthenticated user inject data into a PHP session file via a crafted request, making the session appear authenticated. Combined with arbitrary directory creation and a command injection in an authenticated endpoint, this yields root command execution.
Impact
Unauthenticated root code execution on firewalls with an exposed management interface.
Detection
Version-check PAN-OS; review management web logs for requests to /esp/cms_changeDeviceContext.esp from untrusted sources.
Mitigation
Upgrade and restrict management access to trusted networks.