Palo Alto Zero-Day Vulnerability (CVE-2024-0012)

THE THREAT

On November 18th, 2024, Palo Alto disclosed a critical actively exploited authentication bypass zero-day vulnerability impacting Palo Alto Networks PAN-OS. The vulnerability is tracked as CVE-2024-0012 (CVSS: 9.3); exploitation would allow a remote and unauthenticated threat actor to perform administrative actions, edit configurations, and exploit other authenticated vulnerabilities. To date, real-world exploitation has been limited to cases where the device’s management web interface was exposed to the public Internet.

As exploitation is ongoing, it is critical that organizations apply the relevant security patches and restrict access to Palo Alto management web interfaces.

What we’re doing about it

• The eSentire Threat Intelligence team has performed indicator-based threat hunts across the customer base
• Known Indicators of Compromise are blocked via the eSentire Global Block list
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins to identify this vulnerability as they become available
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the vendor provided security patches
• Access to Palo Alto management web interfaces should be restricted to trusted internal IP addresses only
• At risk devices may be identified via the Assets section of the Palo Alto Customer Success Portal

Additional information

According to Palo Alto, exploitation of CVE-2024-0012 has been identified impacting a “limited number of management web interfaces that are exposed to internet traffic”.

Security researchers from Rapid7 have observed exploitation of the vulnerability in a campaign tracked under the name Operation Lunar Peek. They specifically note that exploitation would allow threat actors to exploit other authenticated privilege escalation vulnerabilities including CVE-2024-9474. Observed post-exploitation activity includes the deployment of webshells for persistent access.

Fixed PAN-OS Versions:

• PAN-OS 10.2.12-h2
• PAN-OS 11.0.6-h1
• PAN-OS 11.1.5-h1
• PAN-OS 11.2.4-h1
• All later PAN-OS versions

References:

[1] https://security.paloaltonetworks.com/CVE-2024-0012
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-0012
[3] https://www.rapid7.com/blog/post/2024/11/15/etr-zero-day-exploitation-targeting-palo-alto-networks-firewall-management-interfaces/
[4] https://nvd.nist.gov/vuln/detail/CVE-2024-9474