CVE-2024-3400
Published: 12 April 2024
Summary
CVE-2024-3400 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Paloaltonetworks Pan-Os. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability CVE-2024-3400 is a command injection resulting from arbitrary file creation in the GlobalProtect feature of Palo Alto Networks PAN-OS software on specific versions and distinct feature configurations. Successful exploitation allows unauthenticated attackers to run arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not affected.
An unauthenticated remote attacker can exploit the flaw over the network without user interaction to achieve full root-level code execution on impacted firewalls, consistent with the CVSS 10.0 rating tied to CWE-20 and CWE-77.
Palo Alto Networks security advisories along with Unit 42 and Volexity analyses at the listed reference URLs describe mitigation guidance and patch availability for supported PAN-OS releases. The EPSS score reached a peak of 0.9648 with a current value of 0.9430, and Volexity reporting explicitly addresses observed zero-day exploitation in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31989
Vulnerability details
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root…
more
privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
- CWE(s)
- KEV Date Added
- 12 April 2024
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the arbitrary file creation and subsequent command injection by validating all externally supplied input to the GlobalProtect interface before processing.
Requires prompt application of vendor patches that eliminate the unauthenticated code-execution flaw in the affected PAN-OS GlobalProtect code paths.
Enforces disabling or restricting the GlobalProtect feature when not required, thereby removing the attack surface that the CVE exploits.