High
CVE-2024-9474
CVE-2024-9474
Description
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Add Assessment
Technical Analysis
CVE-2024-9474 was exploited in the wild as part of an exploit chain, paired with the authentication bypass CVE-2024-0012, to allow for unauthenticated RCE. On its own, CVE-2024-9474 would require authentication.
A technical analysis of CVE-2024-9474 shows this vulnerability is a command injection, allowing an attacker to execute arbitrary OS commands with root privileges.
An attacker can make a POST request to the /php/utils/createRemoteAppwebSession.php endpoint, which will create a new PHP session, returning a new PHPSESSID cookie. This POST request allows an attacker to supply an arbitrary username for the new session. The username value will be stored in a session object. A second HTTP request, for example to /index.php, can then trigger the command injection when the function AuditLog.write is called, and the poisoned username value from the new session is passed to a call to pexecute, and a command injection can be achieved.
A Metasploit exploit module for the exploit chain comprising of the auth bypass CVE-2024-0012, and the command injection CVE-2024-9474 is available. Based on writing this exploit module, I have rated both the attacker value, and the exploitability of this as high, as a target PAN-OS management interface is vulnerable in a default configuration, and compromising a PAN-OS device is a high value target for an attacker, however this vulnerability is authenticated so needs to be paired with an auth bypass.
CVSS V3 Severity and Metrics
General Information
Vendors
- paloaltonetworks
Products
- pan-os,
- pan-os 10.1.14,
- pan-os 10.2.12,
- pan-os 11.0.6,
- pan-os 11.1.5,
- pan-os 11.2.4
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
Miscellaneous
