.webp)
A vulnerability is present in PAN-OS 10.2, 11.0, and 11.1 firewalls configured with GlobalProtect gateway or portal with device telemetry enabled. This critical weakness identified as CVE-2024-3400 (CVSS 3.0: 10) is a command injection vulnerability which may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Palo Alto Networks is aware of a limited number of attacks that leverage the exploitation of this vulnerability. Threat actors utilized a backdoor after exploitation to perform data exfiltration and lateral movement throughout the network.
This vulnerability only affects a select few PAN-OS versions and they need to be configured with GlobalProtect gateway, GlobalProtect Portal, or both while device telemetry is enabled.
Affected Software:
If this vulnerability is exploited it has the potential to be of significant impact because threat actors utilizing the vulnerability can move laterally through a target network to exfiltrate sensitive data using a backdoor.
It is essential to verify if your organization utilizes Palo Alto Firewalls and, if they do, to verify the configuration by checking the OS version and whether CloudProtect gateway or portal is enabled with device telemetry. If you are on a vulnerable version, the next step is to remediate.
The vulnerability is and will be fixed in hotfix releases of PAN-OS:
PAN-OS 10.2:
PAN-OS 11.0:
PAN-OS 11.1:
If using the Threat Prevention subscription Palo Alto describes that Threat ID 95187 will prevent exploitation of this issue.
If you are unable to apply Threat Prevention temporarily disabling device telemetry will prevent exploitation until the device is upgraded to a fixed version. Once upgraded it is recommended to re-reenable device telemetry.
Threat hunters can also utilize XQL queries described in Unit 42’s synopsis of the issue.
Exploitation of this vulnerability can be extremely determinantal to any business or organization. There have been targeted attacks utilizing this vulnerability which have opened up backdoors in organizational networks allowing for data exfiltration and lateral movement. If used on any business monetary and data loss are to be expected.
Patch: We recommend patching any applicable devices utilizing PAN-OS as soon as possible. This should be a number one priority as there is evidence of zero-day exploitation.
Mitigate: Mitigating the threat by disabling device telemetry will buy time and keep the network secure while upgrades are underway.
Utilize threat hunters: Unit 42 has described multiple XQL queries to search for signs of exploitation. This should be done if you or your organization is or was on a vulnerable version. The queries are described here: https://unit42.paloaltonetworks.com/cve-2024-3400/
https://nvd.nist.gov/vuln/detail/CVE-2024-3400
https://security.paloaltonetworks.com/CVE-2024-3400
In December 2020, Ticketmaster was hit with a $10 million fine for an act of corporate espionage. The company had engaged in unauthorized access to a competitor's computer systems, using stolen login credentials to gather confidential business intelligence. Although this scandal broke nearly four years ago, it serves as a reminder of the legal and ethical responsibilities businesses must adhere to in today’s marketplace.
Hospitals and healthcare providers have increasingly become targets of cyberattacks, which pose significant risks to patient care and safety. This document examines the various ways in which cyberattacks can disrupt hospital operations, compromise patient data security, and ultimately affect the quality of patient care. It also explores strategies and best practices that hospitals can implement to mitigate these risks and enhance their cybersecurity posture.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
