CVE-2024-3400: PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Other sources
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
— CISA
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.9-h1 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.0.4-h1 - Upgrade
Upgrade
Palo Alto PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.2-h3 - Configuration
Enable the Threat Prevention IDs provided by Palo Alto Networks to mitigate exploitation of the GlobalProtect command injection vulnerability on vulnerable PAN-OS devices.
PAN-OS (Threat Prevention) Threat Prevention IDs = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3400?
CVE-2024-3400 is classified as a critical vulnerability due to its potential to allow unauthenticated attackers to execute arbitrary code with root privileges.
How do I fix CVE-2024-3400?
To remediate CVE-2024-3400, upgrade your Palo Alto Networks PAN-OS software to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-3400?
CVE-2024-3400 affects specific versions of Palo Alto Networks PAN-OS, including versions 10.2.x and 11.0.x.
What types of attacks can exploit CVE-2024-3400?
CVE-2024-3400 can be exploited for command injection attacks, potentially allowing remote code execution on affected systems.
Is there a workaround for CVE-2024-3400 until a fix is applied?
No specific workarounds have been published for CVE-2024-3400, so applying the recommended software updates is essential for security.