Dear reader,
On 18 November 2024, Palo Alto Networks issued a security advisory for an authentication bypass vulnerability in the PAN-OS management web interface. The vulnerability is tracked under CVE-2024-0012 [1] and has a CVSS score for this is 9.3 [2]. The vulnerability allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. As the Northwave CERT has already observed mass exploitation by multiple threat actors, we urge all recipients to implement mitigation measures and patch their systems.
Description
The vulnerability, tracked as CVE-2024-0012 could allow an unauthenticated attacker to gain administrative privileges and perform administrative actions or exploit privilege escalation vulnerabilities such as CVE-2024-9474 to gain super-user privileges[3]. By exploiting CVE-2024-0012 to gain administrative access and then leveraging CVE-2024-9474 to escalate privileges to root, an attacker could execute arbitrary code on the affected device[4].
The PA-Series, VM-Series, and CN-Series firewalls and on Panorama (virtual and M-Series) are affected by this vulnerability. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
The specific PAN-OS versions that are impacted are as follows:
-
PAN-OS 10.2 (< 10.2.12-h2)
-
PAN-OS 11.0 (< 11.0.6-h1)
-
PAN-OS 11.1 (< 11.1.5-h1)
-
PAN-OS 11.2 (< 11.2.5-h1)
Impact
An unauthenticated attacker could gain administrator access and manipulate the configuration. In addition, given the potential for attackers to exploit CVE-2024-9474 to escalate privileges to root and execute arbitrary code, we estimate the impact of this vulnerability as high.
Risk
At the time of writing, a proof of concept [4] demonstrating how the two vulnerabilities pertaining to CVE-2024-0012 and CVE-2024-9747 can be exploited in combination to achieve remote code execution on affected Palo Alto Networks devices. In addition, successful exploits related to this vulnerability are already being observed. We estimate the risk of this vulnerability as high.
Mitigation
The vulnerabilities are fixed in later versions of PAN-OS than those listed above, therefore applying recent patches to the affected devices is strongly recommended. The risk of exploitation is greatly reduced by restricting access to vulnerable management web interfaces to only trusted internal IP addresses as advised by the best practices deployment guidelines from Palo Alto.
What should you do?
Check if whether one or more of the affected PAN-OS versions are being used by devices on your network. Palo Alto also provides a list of known assets that require remediation, where those devices that are internet-facing are specifically tagged [1]. If affected products are identified, we recommend installing the most recent patches and to ensure access to the web interface is restricted. If devices were not patched and exposed to the internet, it is very likely that a breach has occurred. It is possible to upload Tech Support Files (TSF) to Palo Alto to check for signs of threat activity [1].
What will Northwave do?
We will monitor any developments regarding this vulnerability. If new critical information about this threat emerges we will contact you. You can call us by phone or send us an email if you would like additional information.
Especially Vulnerability Management customers will be notified if vulnerable systems are found in their infrastructure.
E-mail: soc@northwave.nl
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000
Disclaimer applies, see below.
Sources