CVE-2024-3400

The vulnerability results from a combination of arbitrary file creation capability with a command injection flaw (CWE-77) in the GlobalProtect component. An attacker, without any authentication, can craft a network request that results in the creation of a malicious file on the system, followed by execution of embedded system commands with root privileges. The vulnerability affects specific versions of PAN-OS and particular GlobalProtect feature configurations.

The attacker gains full control over the firewall device with root privileges, enabling configuration reading and modification, network traffic interception, lateral movement to the internal network, and permanent compromise of the security infrastructure.

Security patches available from the vendor must be applied immediately in accordance with references published at https://security.paloaltonetworks.com/CVE-2024-3400. Until updates are deployed, it is recommended to verify GlobalProtect configuration and monitor devices for signs of compromise.

Palo Alto Networks PAN-OS — specific versions with active GlobalProtect functionality. The vulnerability does NOT affect Cloud NGFW, Panorama devices, or Prisma Access. Detailed version lists are available in vendor references (security.paloaltonetworks.com/CVE-2024-3400).

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.