CVE-2024-9463

An attacker without any authentication can send a specially crafted request to the vulnerable Expedition component, which improperly processes the input and passes it directly to the operating system command interpreter. As a result, arbitrary OS commands can be executed with root privilege level. The lack of user interaction requirement and the absence of authentication or special configuration requirements make this vulnerability exceptionally easy to exploit remotely.

The attacker gains full control over the Expedition system with root privileges, resulting in disclosure of usernames, passwords in cleartext, device configurations, and PAN-OS firewall API keys — which can consequently lead to takeover of managed network devices.

Patches available from the vendor must be applied immediately in accordance with official advisory PAN-SA-2024-0010 (https://security.paloaltonetworks.com/PAN-SA-2024-0010). Until the update is applied, consider restricting network access to the Expedition interface only to trusted hosts and isolating the system from the production network.

Palo Alto Networks Expedition — versions indicated in vendor references (advisory PAN-SA-2024-0010)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.