Exploit

CVE-2024-5910

Missing Authentication for Critical Function (CWE-306)

Published: Jul 10, 2024 / Updated: 4mo ago

Palo Alto Networks has issued an advisory warning of a potential remote code execution (RCE) vulnerability in its PAN-OS management interface. Impact: The potential RCE vulnerability in the PAN-OS management interface raises significant concerns for organizations that rely on Palo Alto Networks’ firewall solutions.

As the vulnerabilities allow bad actors to bypass authentication and take over administrative accounts, they pose a substantial risk to organizations using Palo Alto Expedition and firewalls. In addition to CVE-2024-5910, several other vulnerabilities have been identified in Palo Alto Networks firewalls that allow for remote code execution.

On July 10, 2024, Palo Alto released a security advisory for [CVE-2024-5910](https://security.paloaltonetworks.com/CVE-2024-5910), a vulnerability which allowed attackers to remotely reset the Expedition application admin credentials. We happen upon the file `/var/www/html/bin/CronJobs.php`, because it contains both a call to ‘exec’ and takes user input from the passed request parameters.

Canadian Centre for Cyber Security – Alert – Securing Palo Alto management interfaces from exploitation . CVE-2024-9463 Palo Alto Networks Expedition OS Command Injection Vulnerability

[GitHub]CVE-2024-5910: Missing Authentication for Critical Function (CWE-306)

A spokesperson for Palo Alto Networks (PAN) confirmed patches were available to address these security vulnerabilities, and stated the company is "monitoring a limited set of exploit activities" and is working with external researchers, business partners, and customers to share information in a timely fashion. A report released by the Cybersecurity and Infrastructure Security Agency, a nonprofit organization that monitors and analyzes threats to the nation's infrastructure, found that Palo Alto Networks' firewall management software was actively exploited in the wild on Thursday.

Description: Adds a module to chain CVE-2024-5910, a password reset vulnerability with CVE-2024-9464, an authenticated command-injection vulnerability to gain code execution on PaloAlto Expedition servers between versions after 1.2 and before 1.2.92 with or without knowledge of the credentials. The module makes use of both vulnerabilities in order to obtain unauthenticated RCE in the context of the user www-data.

"Palo Alto Networks has actively monitored and worked with customers to identify and further minimize the very small number of PAN-OS devices with management web interfaces exposed to the Internet or other untrusted networks, " it added in a separate report providing indicators of compromise for ongoing attacks targeting the flaws. "Palo Alto Networks observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network," the company warned today regarding both zero-days.