Detections
Analytics
Palo Alto PAN-OS GlobalProtect Remote Code Execution
critical Web App Scanning Plugin ID 114282
Language:
Synopsis
Palo Alto PAN-OS GlobalProtect Remote Code ExecutionDescription
Palo Alto PAN-OS versions 11.1.x < 11.1.0-h3 / 11.1.1-h1 / 11.1.2-h3, 11.0.x < 11.0.0-h3 / 11.0.1-h4 / 11.0.2-h4 / 11.0.3-h10 / 11.0.4-h1, 10.2.x < 10.2.0-h3 / 10.2.1-h2 / 10.2.2-h5 / 10.2.3-h13 / 10.2.4-h16 / 10.2.5-h6 / 10.2.6-h3 / 10.2.7-h8 / 10.2.8-h3 / 10.2.9-h1 suffer from an arbitrary file write vulnerability in the GlobalProtect feature, enabling a remote and unauthenticated attacker to execute arbitrary code with root privileges on the firewall.Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration.
Solution
For versions 11.1.x, upgrade to version 11.1.0-h3, 11.1.1-h1, 11.1.2-h3 or later. For versions 11.0.x, upgrade to version 11.0.0-h3, 11.0.1-h4, 11.0.2-h4, 11.0.3-h10, 11.0.4-h1 or later. For version 10.2.x, upgrade to version 10.2.0-h3, 10.2.1-h2, 10.2.2-h5, 10.2.3-h13, 10.2.4-h16, 10.2.5-h6, 10.2.6-h3, 10.2.7-h8, 10.2.8-h3, 10.2.9-h1 or later.See Also
https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
Plugin Details
Severity: Critical
ID: 114282
Type: remote
Family: Component Vulnerability
Published: 5/21/2024
Updated: 5/21/2024
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Critical
Score: 10.0
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-3400
CVSS v3
Risk Factor: Critical
Base Score: 10
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score Source: CVE-2024-3400
CVSS v4
Risk Factor: Critical
Base Score: 10
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score Source: CVE-2024-3400
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/12/2024
Vulnerability Publication Date: 4/12/2024
CISA Known Exploited Vulnerability Due Dates: 4/19/2024
Reference Information
CVE: CVE-2024-3400
OWASP: 2010-A1, 2010-A4, 2013-A1, 2013-A4, 2013-A9, 2017-A1, 2017-A5, 2017-A9, 2021-A3, 2021-A6
WASC: Improper Input Handling, OS Commanding
CAPEC: 10, 101, 104, 108, 109, 110, 120, 13, 135, 136, 14, 15, 153, 182, 183, 209, 22, 23, 230, 231, 24, 248, 250, 261, 267, 28, 3, 31, 40, 42, 43, 45, 46, 47, 473, 52, 53, 588, 63, 64, 67, 7, 71, 72, 73, 75, 76, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-002510, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SI-10
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.3, 4.0.2-5.3.8