TrendingExploit
CVE-2024-9474

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Nov 18, 2024 / Updated: 1d ago

010
CVSS 6.9EPSS 2.25%Medium
CVE info copied to clipboard

Summary

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. This vulnerability affects the PAN-OS software, but Cloud NGFW and Prisma Access are not impacted.

Impact

This vulnerability could allow an attacker who already has administrator access to the PAN-OS management web interface to escalate their privileges to root level. This would give them complete control over the firewall, potentially allowing them to modify firewall rules, access sensitive data, or compromise the entire network security infrastructure. The attack vector is network-based, with low attack complexity, requiring no user interaction. The CVSS v4 base score is 6.9 (Medium severity), with high impact on system integrity. The vulnerability is actively being exploited in the wild and has been added to the CISA Known Exploited Vulnerability list, indicating its severity and the urgency for patching.

Exploitation

There is no evidence that a public proof-of-concept exists. The vulnerability is actively being exploited in the wild and was added to the CISA Known Exploited Vulnerability list. Its exploitation has been reported by various sources, including infosec.exchange.

Patch

As of the information provided, there is no specific mention of a patch being available. Given the severity of the vulnerability and its active exploitation, it is crucial for the security team to closely monitor Palo Alto Networks' security advisories for patch information and apply any security updates as soon as they become available.

Mitigation

While waiting for an official patch, the following mitigation steps are recommended: 1. Limit access to the PAN-OS management web interface to only necessary personnel. 2. Implement strong authentication mechanisms for administrator accounts. 3. Monitor and audit administrator activities on the PAN-OS management interface. 4. Consider implementing network segmentation to limit the potential impact if the firewall is compromised. 5. Regularly review and update firewall rules and configurations. 6. Ensure that Cloud NGFW and Prisma Access deployments are kept separate, as they are not affected by this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red

Timeline

Exploitation in the Wild

Attacks in the wild have been reported by inthewild.io.

Nov 18, 2024 at 12:00 AM / inthewild.io
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (731914)

Nov 18, 2024 at 7:53 AM
First Article

Feedly found the first article mentioning CVE-2024-9474. See article

Nov 18, 2024 at 3:33 PM / Help Net Security
Exploitation in the Wild

Attacks in the wild have been reported by #threatintel. See article

Nov 18, 2024 at 3:33 PM / #threatintel
Threat Intelligence Report

CVE-2024-9474 is a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management interface to gain administrator privileges, enabling them to perform administrative actions and exploit other privilege escalation vulnerabilities. The vulnerability is associated with the Web Management Interface and poses significant risks to the configuration integrity of affected systems. There is no information provided regarding CVSS scores, exploitation in the wild, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors. See article

Nov 18, 2024 at 3:33 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 18, 2024 at 3:55 PM
CVE Assignment

NVD published the first details for CVE-2024-9474

Nov 18, 2024 at 4:15 PM
CVSS

A CVSS base score of 6.9 has been assigned.

Nov 18, 2024 at 4:20 PM / nvd
Exploitation in the Wild

Attacks in the wild have been reported by CISA Known Exploited Vulnerability.

Nov 18, 2024 at 7:20 PM / CISA Known Exploited Vulnerability
Static CVE Timeline Graph

Affected Systems

Paloaltonetworks/pan-os
+null more

Proof Of Exploit

https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+null more

Patches

security.paloaltonetworks.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
Palo Alto Networks observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network. An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474.
Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Palo Alto Networks has identified threat activity potentially exploiting this vulnerability against a limited number of management web interfaces. Palo Alto Networks and Unit 42 are engaged in tracking a limited set of exploitation activity related to CVE-2024-0012 and are working with external researchers, partners, and customers to share information transparently and rapidly.
CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface (Severity: MEDIUM)
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. If you configure a specific list of IP addresses that only allow access to the management interface, you greatly reduce the risk of exploitation because attacks would require privileged access using only those IP addresses.
See 13 more references

News

Chocapikk pushed to main in Chocapikk/CVE-2024-9474
You signed in with another tab or window. You signed out in another tab or window.
Chocapikk created a branch main in Chocapikk/CVE-2024-9474
Confirm that selected head ref is valid, then try again. Confirm that selected base ref is valid, then try again.
Risky Business #771 -- Palo Alto's firewall 0days are very, very stupid
The always excitable Andrew Morris joins to remind us that the edge-device vulnerabilities Pat and Adam complain about on the show are in fact actually even worse than we make them out to be. Academic research supports your gut-reaction; phishing training doesn’t work
Risky Business Weekly (771): Palo Alto's firewall 0days are very, very stupid
Palo Alto Networks customers grapple with another actively exploited zero-day | Cybersecurity Dive https://therecord.media/nist-vulnerability-backlog-cleared-cisa
Analysis & PoC Exploits Released for Palo Alto Zero-Days – CVE-2024-0012 and CVE-2024-9474
In a recent analysis, security researcher Sonny from watchTowr unveiled the technical intricacies of two zero-day vulnerabilities affecting Palo Alto Networks’ Next-Generation Firewalls (NGFW). The researcher observed that the X-PAN-AUTHCHECK header was not set correctly in unpatched versions, potentially allowing unauthorized access to supposedly protected endpoints.
See 150 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:High
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI