GlobalProtect Portal VPN Vulnerability

THE THREAT

Security researchers have identified a critical vulnerability impacting Palo Alto Networks firewalls using the GlobalProtect Portal VPN. The vulnerability is tracked at CVE-2021-3064 (CVSS: 9.8). Exploitation of this vulnerability allows an unauthenticated remote threat actor to disrupt system processes and cause Remote Code Execution (RCE); exploitation may allow an attacker to gain initial access into networks and enable lateral movement.

Attacks involving CVE-2021-3064 have not been identified at this time. Threat actors are expected to abuse this vulnerability in the near future as the attack complexity is low and the potential impact of abuse is high.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) will automatically add the relevant plugins for this vulnerability once details are made available
• eSentire security teams are tracking this threat for additional details and detection opportunities

What you should do about it

• Update to PAN-OS version 8.1.17 or later
  • If patching is not possible, temporary work arounds are available in the official Palo Alto vulnerability release

Additional information

CVE-2021-3064 impacts PAN-OS 8.1, versions earlier than PAN-OS 8.1.17. The vulnerability was discovered by Randori; the company has confirmed that it was able to develop reliable exploit code. Randori has stated that technical details will be released in thirty days, after organizations have had time to deploy security patches. It is critical that impacted organizations deploy patches before these details are released, as this release will increase the likelihood of exploitation by threat actors.

According to results from the IoT search engine Shodan, there are over 10,000 vulnerable exposed instances of PAN-OS that are internet facing.

References:

[1] https://www.randori.com/blog/cve-2021-3064/
[2] https://security.paloaltonetworks.com/CVE-2021-3064