.webp)
A vulnerability is present in PAN-OS 10.2, 11.0, and 11.1 firewalls configured with GlobalProtect gateway or portal with device telemetry enabled. This critical weakness identified as CVE-2024-3400 (CVSS 3.0: 10) is a command injection vulnerability which may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Palo Alto Networks is aware of a limited number of attacks that leverage the exploitation of this vulnerability. Threat actors utilized a backdoor after exploitation to perform data exfiltration and lateral movement throughout the network.
This vulnerability only affects a select few PAN-OS versions and they need to be configured with GlobalProtect gateway, GlobalProtect Portal, or both while device telemetry is enabled.
Affected Software:
If this vulnerability is exploited it has the potential to be of significant impact because threat actors utilizing the vulnerability can move laterally through a target network to exfiltrate sensitive data using a backdoor.
It is essential to verify if your organization utilizes Palo Alto Firewalls and, if they do, to verify the configuration by checking the OS version and whether CloudProtect gateway or portal is enabled with device telemetry. If you are on a vulnerable version, the next step is to remediate.
The vulnerability is and will be fixed in hotfix releases of PAN-OS:
PAN-OS 10.2:
PAN-OS 11.0:
PAN-OS 11.1:
If using the Threat Prevention subscription Palo Alto describes that Threat ID 95187 will prevent exploitation of this issue.
If you are unable to apply Threat Prevention temporarily disabling device telemetry will prevent exploitation until the device is upgraded to a fixed version. Once upgraded it is recommended to re-reenable device telemetry.
Threat hunters can also utilize XQL queries described in Unit 42’s synopsis of the issue.
Exploitation of this vulnerability can be extremely determinantal to any business or organization. There have been targeted attacks utilizing this vulnerability which have opened up backdoors in organizational networks allowing for data exfiltration and lateral movement. If used on any business monetary and data loss are to be expected.
Patch: We recommend patching any applicable devices utilizing PAN-OS as soon as possible. This should be a number one priority as there is evidence of zero-day exploitation.
Mitigate: Mitigating the threat by disabling device telemetry will buy time and keep the network secure while upgrades are underway.
Utilize threat hunters: Unit 42 has described multiple XQL queries to search for signs of exploitation. This should be done if you or your organization is or was on a vulnerable version. The queries are described here: https://unit42.paloaltonetworks.com/cve-2024-3400/
https://nvd.nist.gov/vuln/detail/CVE-2024-3400
https://security.paloaltonetworks.com/CVE-2024-3400
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
