CVE-2024-9474 — PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

Summary

A vulnerability has been discovered in Palo Alto Networks products. It allows an attacker to cause a privilege escalation.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).

Summary

On 8 November 2024, Palo Alto Networks published a security advisory regarding a critical vulnerability in certain Palo Alto Networks firewalls. It allows an unauthenticated attacker to perform remote arbitrary code execution on the management interface of the devices. In an update on 14 November 2024, the vendor stated that it is aware of the exploitation of this vulnerability on firewalls exposing their management interface to the Internet. [Update of 19 November 2024] On 18 November 2024, the vendor published a security advisory concerning vulnerability CVE-2024-9474. This allows privilege escalation and may be used following the vulnerability published on 8 November 2024, now identified as CVE-2024-0012, in order to obtain the highest rights on the device. A proof of concept enabling the exploitation of these two vulnerabilities is publicly available.

Recommendation

[Update of 18 November 2024] Patches are available for this vulnerability. The most at-risk firewalls are those exposing their management interface on the Internet. Palo Alto Networks has indicated that it has performed a scan to identify these interfaces and informed the owners of affected equipment through their customer portal (see the *Required Configuration for Exposure* section of the security advisory). In addition, the vendor provides a guide for securing management interfaces [1]. If a management interface is exposed or has been exposed on the Internet, CERT-FR recommends: 1. isolating the equipment from the network and performing a data freeze (snapshot for virtual machines, isolation of the equipment if it is a physical device) for in-depth investigations; 2. rebuilding the solution with an up-to-date version and following the vendor's security recommendations for deploying the management interface. If the management interface is not exposed on the Internet, the equipment remains vulnerable to exploitation by an attacker with access to the interface, for example from an administration network. CERT-FR therefore recommends monitoring connections or connection attempts to the equipment. In case of suspected compromise, it is recommended to consult the [good practices in case of intrusion on your information system](/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/) [2], as well as the quick response sheets on system compromise [3] [4].