simontsui OP , 2 months ago

Hot off the press! CISA adds CVE-2024-3400 (10.0 critical, disclosed 12 April 2024, PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway) to the Known Exploited Vulnerabilities (KEV) Catalog 🔗 https://www.cisa.gov/news-events/alerts/2024/04/12/cisa-adds-one-known-exploited-vulnerability-catalog

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability

simontsui OP , 2 months ago

Just to make it easier to read through the various reports (saying almost the same exact thing), I've assembled a Palo Alto Networks zero-day MEGA list:

• Palo Alto Networks security advisory: CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway

UPDATE: Volexity and Unit 42 talk about the threat actor, campaign, and include indicators of compromise:

• Volexity: Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
• Unit 42: Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400

Here's the rest of the related reporting:

• Zscaler: Another CVE (PAN-OS Zero Day), Another Reason to Consider Zero Trust
• The Register: Zero-day exploited right now in Palo Alto Networks' GlobalProtect gateways
• Bleeping Computer:
  1. Palo Alto Networks warns of PAN-OS firewall zero-day used in attacks
  2. (update) Palo Alto Networks zero-day exploited since March to backdoor firewalls
• SANS ISC: Critical Palo Alto GlobalProtect Vulnerability Exploited (CVE-2024-3400)
• CERT-EU: Critical Vulnerability in PAN-OS software
• Qualys: PAN-OS OS Command Injection Vulnerability Exploited in the Wild (CVE-2024-3400)
• Rapid7: CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls
• The Hacker News:
  1. Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack
  2. (update) Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack
• Security Week:
  1. Palo Alto Networks Warns of Exploited Firewall Vulnerability
  2. (update) State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls
• SOCRadar: Critical OS Command Injection Vulnerability in Palo Alto's GlobalProtect Gateway: CVE-2024-3400. The patch is not available yet.
• CISA:
  1. CISA Adds One Known Exploited Vulnerability to Catalog
  2. Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400
• The Record: Palo Alto Networks warns of zero-day in VPN product
• Ars Technica:“Highly capable” hackers root corporate networks by exploiting firewall 0-day

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #threatintel #IOC

simontsui OP , 2 months ago

CISA put out an additional security alert about CVE-2024-3400, noting that Palo Alto Networks released workaround guidance for the command injection vulnerability. 🔗 https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #CISA

simontsui OP , 2 months ago

It should come as no surprise that Palo Alto Networks did not release hotfixes* for affected versions of PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11 by the self-imposed deadline of Sunday 14 April 2024 like they estimated in their security advisory. 48 hours to develop/test/release is a tight delivery window with the whole infosec community breathing down their necks.

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #threatintel #IOC

jerry , 2 months ago

@simontsui it seemed super optimistic to me

chinetsec , 2 months ago

@jerry @simontsui luckily it has a super easy mitigation. Turning the telemetry off would impact AIOps but nothing in production

jerry , 2 months ago

@chinetsec @simontsui I was happy to learn that we didn’t have telemetry enabled. That said, I think we are in for a rough few months of palo vulns

chinetsec , 2 months ago

@jerry @simontsui Yeah, unfortunately newer versions on PAN-OS have it enabled by default. This constant merry-go-round of vendors taking their time in the spotlight for RUVPN vulnerabilities is what makes me interested in alternative options like Zcaler’s ZPA or Prisma Access. One less thing exposed at the edge, but they have their own pros and cons too.