This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Palo Alto Networks fixes 5 vulnerabilities and warns of a critical vulnerability

Palo Alto Networks fixes 5 vulnerabilities in Expedition with version 1.2.96 [1], two of which have been added to CISA's list of known, actively exploited vulnerabilities [2]. In addition, the company warns of a critical vulnerability affecting devices whose management interface is openly accessible from the internet. We strongly recommend restricting access to this interface to trusted IP addresses only. According to Palo Alto Networks, this vulnerability is already being actively exploited [3].

Palo Alto Networks Expedition - SQL injection (CVE-2024-9465)
CVSS 9.1 (Critical)

An unauthenticated remote attacker is able, through SQL injection, to disclose the contents of the database, including password hashes, usernames, device configurations and API keys, as well as to create and read arbitrary files [4]. The vulnerability is already being actively exploited [2].

The vulnerability is present in product:

  • Palo Alto Networks Expedition; >=1.2.0, <1.2.96;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

  • CVE-2024-9465 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.

Palo Alto Networks Expedition - OS command execution (CVE-2024-9463)
CVSS 9.8 (Critical)

An unauthenticated remote attacker is able to execute commands with root privileges in the operating system of the affected device and thus gain access to sensitive information such as usernames, cleartext passwords, device configurations and API keys for PAN-OS firewalls [5]. The vulnerability is already being actively exploited [2].

The vulnerability is present in product:

  • Palo Alto Networks Expedition; >=1.2.0, <1.2.96;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-9463 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.

Palo Alto Networks Expedition - OS command execution (CVE-2024-9464)
CVSS 8.8 (High)

An authenticated remote attacker is able to execute commands with root privileges in the operating system of the affected device and thus gain access to sensitive information such as usernames, cleartext passwords, device configurations and API keys for PAN-OS firewalls [6].

The vulnerability is present in product:

  • Palo Alto Networks Expedition; >=1.2.0, <1.2.96;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-9464 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.

Palo Alto Networks Expedition - credential disclosure (CVE-2024-9466)
CVSS 6.5 (Medium)

Allows an authenticated local attacker, due to sensitive information being stored in clear text, to disclose firewall usernames, passwords and API keys [7].

The vulnerability is present in product:

  • Palo Alto Networks Expedition; >=1.2.0, <1.2.96;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 9. 10. 2024.

Palo Alto Networks Expedition - XSS (CVE-2024-9467)
CVSS 5.4 (Medium)

Allows an unauthenticated remote attacker, using social engineering, to carry out a reflected XSS attack, which may lead to theft of an authenticated user's session [8].

The vulnerability is present in product:

  • Palo Alto Networks Expedition; >=1.2.0, <1.2.96;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

More information:

  • CVE-2024-9467 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 10. 2024.

Palo Alto Networks management interface - command execution
CVSS 10.0 (Critical)

Allows an unauthenticated remote attacker to execute commands in the management interface [3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 11. 2024.

By CESNET, z.s.p.o. Michaela Ručková on 15. 11. 2024.

CESNET, z.s.p.o. Logo