PAN-OS GlobalProtect Command Injection
- Product
- Palo Alto Networks PAN-OS GlobalProtect
- CVE
- CVE-2024-3400
- Disclosed
- 2024-04-12
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- PAN-OS 10.2 < 10.2.9-h1, 11.0 < 11.0.4-h1, 11.1 < 11.1.2-h3 with GlobalProtect gateway or portal configured.
- Fixed
- 10.2.9-h1, 11.0.4-h1, 11.1.2-h3 (plus hotfixes for other maintenance releases).
Summary
Volexity found a zero-day in PAN-OS GlobalProtect exploited by UTA0218 to deploy a Python backdoor (UPSTYLE). The bug allowed unauthenticated attackers to create files with attacker-chosen names that were later fed to a shell, giving root code execution.
Root cause
The GlobalProtect service used the session cookie value as a filename without sanitizing traversal sequences, allowing arbitrary empty file creation. A scheduled telemetry job later builds a shell command from filenames in a directory, so a filename containing shell metacharacters is executed as root.
Impact
Unauthenticated root code execution on the firewall.
Detection
Search gpsvc.log for SESSID values containing traversal sequences, and check for unexpected files in telemetry directories; Palo Alto Threat Prevention signature 95187. Nuclei template CVE-2024-3400.
Mitigation
Apply hotfixes; perform a private-data factory reset if compromise is suspected.