THE THREAT
On April 12th, 2024, Palo Alto Networks disclosed a critical, actively exploited vulnerability in Palo Alto Networks’ firewalls. Tracked as CVE-2024-3400 (CVSS: 10), this is a command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software. Exploitation of CVE-2024-3400 would allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the firewall.
The vulnerability, along with real-world exploitation, was identified by Volexity and reported to Palo Alto. As exploitation has been confirmed, it is critical that organizations apply the security patches provided by Palo Alto as soon as possible. Alternative mitigations are available if patches cannot be applied immediately.
What we’re doing about it
- eSentire MDR for Network has rules in place to identify the exploitation of CVE-2024-3400
- eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2024-3400
- eSentire's Threat Response Unit (TRU) has performed threat hunts across our customer base for known Indicators of Compromise (IoCs)
- Additional detection opportunities are being evaluated based on the release of new technical details
What you should do about it
- After performing a business impact review, apply the relevant security patches immediately
- If security patches cannot be deployed, organizations should enforce the mitigation steps provided by Palo Alto until patching becomes possible
- Enable Vulnerability Protection for the GlobalProtect interface
- Organizations that subscribe to Palo Alto Threat Prevention should enable Threat ID 95187 to block attacks
Additional information
CVE-2024-3400 resides in the PAN-OS operating system; it specifically impacts PAN-OS versions 10.2, 11.0, and 11.1. The following “hotfixes” were released on April 14th to address the vulnerability: PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, and PAN-OS 11.1.2-h3. Palo Alto Networks Panorama appliances, Cloud NGFW, and Prisma Access solutions are not impacted.
Palo Alto’s Unit42 has released a report including details on observed attacks and known Indicators of Compromise (IoCs); the current campaign is being tracked under the name Operation MidnightEclipse. After initial exploitation, threat actors have been observed deploying reverse shells and the UPSTYLE backdoor, as well as executing a variety of commands on the firewall, including copying and exfiltrating configuration files. Volexity tracks the threat actor group behind Operation MidnightEclipse as UAT0218.
On April 16th, watchTowr released a technical analysis of CVE-2024-3400. Their analysis reveals that manipulation of the SESSID cookie can lead to arbitrary file writes and potentially command execution, showcasing an attack vector where telemetry settings increase vulnerability. Rather than releasing traditional Proof-of-Concept (PoC) exploit code, they chose to demonstrate the exploit's viability through a hypothetical scenario that explains the step-by-step manipulation process. The goal of this method is to both inform security professionals about the severity and mechanics of the exploit and to prompt rapid remediation efforts without equipping potential attackers with a ready-made exploit script. While crucial for informing and protecting the cybersecurity community, this information inevitably carries the risk of aiding threat actors. Such detailed disclosures, especially those involving step-by-step exploitation methods or revealing specific weak points in software, can serve as a blueprint for malicious actors. This accessibility of information can lower the barrier for entry for less skilled attackers to exploit these vulnerabilities, potentially leading to an increase in the number of threat actors attempting to leverage the exploit. The eSentire Threat Intelligence team assesses with moderate confidence that more threat actors will attempt to exploit CVE-2024-3400 following the release of these technical details.
References:
[1] https://security.paloaltonetworks.com/CVE-2024-3400
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-3400
[3] https://twitter.com/stevenadair/status/1778724526274052445
[4] https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/device-telemetry/device-telemetry-configure/device-telemetry-disable
[5] https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184
[6] https://unit42.paloaltonetworks.com/cve-2024-3400/
[7] https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
[8] https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
