Palo Alto Networks Updates Mitigations as Exploitation of 0Day Firewall Vulnerability Grows
Exploitation of a recently disclosed zero-day vulnerability affecting Palo Alto Networks firewalls has grown since proof-of-concept exploits were released, and a previously recommended mitigation is ineffective at preventing exploitation of the flaw.
The vulnerability, tracked as CVE-2024-3400, is a command injection flaw in versions 10.2, 11.0, and 11.1 of the PAN-OS operating system that powers its firewalls. The vulnerability is thought to have been exploited since March 26, 2024, initially by a nation-state-affiliated group tracked as Operation MidnightEclipse; however, Palo Alto Networks has detected an additional 20 IP addresses attempting to exploit the flaw.
The vulnerability affects the GlobalProtect gateway or portal VPN feature on certain PAN-OS devices, and can be exploited by an unauthenticated attacker to execute arbitrary code with root privileges. The vulnerability has a maximum CVSS v3 severity score of 10. According to security researchers at Rapid7, the vulnerability is being exploited as part of an exploit chain, along with a second vulnerability that has yet to have a CVE assigned. The second vulnerability is a file creation vulnerability in the GlobalProtect web server.
Initially, Palo Alto Networks said PAN-OS firewalls are vulnerable to attack if GlobalProtect gateway and device telemetry are both enabled. Palo Alto Networks released an initial security advisory about the flaw on Friday, along with recommended mitigations. A secondary mitigation action suggested by Palo Alto Networks was disabling device telemetry; however, Palo Alto has now confirmed that the mitigation is no longer effective, as vulnerable firewalls do not need device telemetry to be enabled to be exposed to attacks.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
According to SharowServer, around 156,000 vulnerable Palo Alto Networks devices are exposed to the Internet, although it is unclear how many of those devices have been patched. To remediate the vulnerability, customers should ensure a hotfix is applied. Rapid7 has confirmed that the hotfixes released by Palo Alto networks are effective at preventing the exploitation of CVE-2024-3400.
The hotfixes are PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and all later versions. On Thursday and Friday, Palo Alto Networks released hotfixes for other commonly deployed maintenance releases, as detailed in an updated HC3 Sector Alert from the Health Sector Cybersecurity Coordination Center (HC3).
