PAN-OS Management Interface Auth Bypass + Privilege Escalation
- Product
- Palo Alto Networks PAN-OS management web interface
- CVE
- CVE-2024-0012CVE-2024-9474
- Disclosed
- 2024-11-18
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- PAN-OS 10.2 < 10.2.12-h2, 11.0 < 11.0.6-h1, 11.1 < 11.1.5-h1, 11.2 < 11.2.4-h1 (CVE-2024-9474 also 10.1 < 10.1.14-h6).
- Fixed
- 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1, 10.1.14-h6.
Summary
An authentication bypass on the PAN-OS management web interface chained with a privilege-escalation command injection gave unauthenticated root access. Palo Alto tracked exploitation as Operation Lunar Peek, and thousands of exposed management interfaces were compromised.
Root cause
CVE-2024-0012: the front-end web server decides whether to enforce authentication via an internal header, and requests to certain path patterns allowed a client-supplied value for that header to disable the check. CVE-2024-9474: a PHP endpoint for creating sessions stores a username value that is later interpolated into a shell command, allowing command injection as root.
Impact
Unauthenticated root code execution on the firewall via its management interface.
Detection
Look for unusual requests to /php/ztp_gate.php and createRemoteAppwebSession.php, and unexpected PHP files in web directories. Nuclei templates exist.
Mitigation
Upgrade, and restrict the management interface to trusted internal IPs.