Target Industry 

Indiscriminate, opportunistic targeting. 

Overview 

Five vulnerabilities of critical and high severity have been reported about Palo Alto Networks Expedition with CVSS version 4.0 scores ranging from 9.9 to 7.0: 

• CVE-2024-9463, CVSS version 4.0 score 9.9, is a critical OS command injection vulnerability 

• CVE-2024-9464, CVSS version 4.0 score 9.3, is a critical OS command injection vulnerability 

• CVE-2024-9465, CVSS version 4.0 score 9.2, is a critical SQL injection vulnerability 

• CVE-2024-9466, CVSS version 4.0 score 8.2, is a high severity vulnerability relating to the cleartext storage of sensitive information 

• CVE-2024-9467, CVSS version 4.0 score 7.0, is a high severity reflected XSS vulnerability. 

These vulnerabilities would enable an attacker to read Expedition database content, read arbitrary files, and write arbitrary files to temporary storage locations on the Expedition system. In combination, these vulnerabilities would allow an attacker to access information including usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. This issue affects older versions of Expedition. 

Impact 

These vulnerabilities can be exploited to access sensitive data, such as user credentials, that can then be used to help take over firewall administration accounts. These vulnerabilities have CVSS v4.0 scores up to and including 9.9, classifying them as having a severity level up to and including critical due to the low complexity required for exploitation.  

Vulnerability Detection  

Palo Alto has released a security update addressing the security flaw in the respective product versions. As such, previous versions are vulnerable to potential exploits. 

Exploitation  

There is no known malicious exploitation of this vulnerability at this time, however, there is a publicly available Proof of Concept with code. 

Containment, Mitigations & Remediations  

Palo Alto Networks Expedition versions lower than 1.2.96 are affected, version 1.2.96 and above are unaffected. 

We strongly recommend that users of affected systems apply the update as soon as possible. 

After the update is applied all Expedition usernames, passwords, and API keys and all firewall usernames, passwords, and API keys processed by Expedition should be rotated. 

If immediate patching is not possible then, as an interim step, Expedition network access should be restricted to authorised users, hosts, or networks.  

Threat Landscape 

Palo Alto occupies a significant proportion of the networking-hardware market share. Given that threat actors generally utilise a combination of probability and asset value to determine which attack surfaces to develop exploits for, Palo Alto networking hardware products have emerged as a prime target for threat actors. Due to the fact that Palo Alto products have become an integral aspect of business operations, threat actors will continue to exploit the vulnerabilities of these product types in an attempt to exfiltrate sensitive data contained therein or impact associated business operations. 

Threat Group 

There is no known malicious exploitation of this vulnerability at this time. 

Further Information 

https://security.paloaltonetworks.com/PAN-SA-2024-0010 

https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-firewall-hijack-bugs-with-public-exploit/ 

https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/