Actively exploited · Published Apr 12, 2024 · Assigned by palo_alto
CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Critical 10.0 Exploited Ransomware
In plain English
A critical-severity command injection in Cloud NGFW from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on April 12, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
CISA guidance
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Federal agencies must remediate by Apr 19, 2024.
Official description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | PAN-OS | 10.2.0 – before 10.2.9-h111.0.0 – before 11.0.4-h111.1.0 – before 11.1.2-h3 |
| Palo Alto Networks | Cloud NGFW | see references |
| Palo Alto Networks | Prisma Access | see references |
Weakness: CWE-77, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://security.paloaltonetworks.com/CVE-2024-3400 vendor-advisory
- https://unit42.paloaltonetworks.com/cve-2024-3400/ technical-description
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ technical-description
- https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ technical-description
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400 government-resource