CVE-2024-5921: GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation (Severity: MEDIUM)
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.
Other sources
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Please subscribe to our RSS feed (https://security.paloaltonetworks.com/rss.xml) to be alerted to new updates to this and other advisories.
— Palo Alto Networks
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks GlobalProtectto a version that resolves this vulnerability.Fixed in 6.3.2Fixed in 6.2.6 - Upgrade
Upgrade
Palo Alto Networks GlobalProtectto a version that resolves this vulnerability.Fixed in 6.3.2Fixed in 6.2.6-c857 - Upgrade
Upgrade
Palo Alto Networks GlobalProtectto a version that resolves this vulnerability.Fixed in 6.2.1-c31 - Upgrade
Upgrade
Palo Alto Networks GlobalProtectto a version that resolves this vulnerability.Fixed in 6.1.7 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect appto a version that resolves this vulnerability.Fixed in 6.2.1-c31 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect appto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect appto a version that resolves this vulnerability.Fixed in 6.2.6-c857 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect appto a version that resolves this vulnerability.Fixed in 6.3.2 - Configuration
Enable full-chain certificate verification. On Windows, set the REG_SZ value full-chain-cert-verify to yes under HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings or deploy GlobalProtect64.msi with FULLCHAINCERTVERIFY="yes". On macOS, add full-chain-cert-verify with string value yes to the Settings section of com.paloaltonetworks.GlobalProtect.settings.plist; on Linux, add the same setting to /opt/paloaltonetworks/globalprotect/pangps.xml.
Palo Alto Networks GlobalProtect app full-chain-cert-verify = yes - Compensating control
Ensure every GlobalProtect portal uses a valid X.509V3 TLS certificate chain meeting the FIPS-CC Certification Validation criteria, and add the portal certificate chains to the operating system root certificate store.
- Operational
Restart Windows after applying the registry change and restart macOS after applying the plist change.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5921?
CVE-2024-5921 has a high severity rating due to its potential to enable unauthorized connections to malicious servers.
How do I fix CVE-2024-5921?
To remediate CVE-2024-5921, update the Palo Alto Networks GlobalProtect app to version 6.3.2 or later.
Which versions of GlobalProtect are affected by CVE-2024-5921?
CVE-2024-5921 affects versions up to 6.3.2, including 6.2.6 and lower versions.
What type of attacks does CVE-2024-5921 enable?
CVE-2024-5921 enables attackers to connect the GlobalProtect app to arbitrary servers, potentially leading to malware installation.
Who is largely impacted by CVE-2024-5921?
Local non-administrative operating system users or attackers on the same subnet using the vulnerable GlobalProtect app are largely impacted by CVE-2024-5921.