PAN-OS GlobalProtect (CVE-2024-3400)

In April 2024 it emerged that attackers had been getting into Palo Alto Networks firewalls since late March. They used a flaw in exactly the component organisations rely on to let staff log in safely from outside.

What is CVE-2024-3400

The GlobalProtect gateway processed a value from a cookie without separating it from the operating-system commands built around it. An attacker who put the right text in that cookie had their own commands run alongside. Those commands ran as root, because that is how the service runs on the appliance.

This is remote code execution in its purest form: no account, no interaction, complete control.

What the attackers did

The researchers who found it named the campaign Operation MidnightEclipse. The attackers wrote a script that read commands out of the web server logs and returned output in a file that passed as a legitimate part of the appliance. That gave them a control channel barely visible in ordinary logging.

Then came the usual sequence: read the configuration, harvest credentials, and step from the firewall into the internal network.

Why the edge is increasingly the target

VPN concentrators, firewalls and gateways share three properties attackers like. They are always internet-facing, they hold broad rights inside the network, and they often run no detection software because they are closed appliances. A breach there is far harder to see than a breach on a workstation.

What to do now

• Verify that PAN-OS runs 10.2.9-h1, 11.0.4-h1, 11.1.2-h3 or later.
• Never expose management interfaces of network equipment directly to the internet. See also security misconfiguration.
• Include edge appliances in your log collection. If nothing is shipped off the device, you learn about a breach when somebody else notices it.
• With a critical flaw in edge equipment, assume exploitation has already happened and go looking for it, rather than only patching.