Low
CVE-2024-9464
CVE-2024-9464
Description
An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Add Assessment
Technical Analysis
Note: While this is an authenticated exploit, CVE-2024-5910 affects the same versions and allows an attacker to reset the admin password to allow authentication.
This vulnerability allows attackers to execute commands on a Palo Alto Expedition web server. The vulnerability is the result of poor sanitization of the start_time parameter when creating a cron_job. By appending a semicolon to the start_time parameter in the web request, a user can then add a command to be executed as www-data.
The attack is somewhat limited by the size of the command, but at ~90 bytes, it is still plenty to use for an attack, especially since the attack is repeatable.
Mitigations:
Given that this appears paired with other exploits (see https://www.horizon3.ai/attack-research/disclosures/palo-alto-expedition-from-n-day-to-full-compromise), patching everything is strongly recommended.
It is possible to limit access through firewall settings and NIDS, but both of those would take far longer and be more difficult than simply patching the affected systems.
CVSS V3 Severity and Metrics
General Information
Vendors
- paloaltonetworks
Products
- expedition
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
