CVE-2024-9474

Published Nov 18, 2024

Last updated 2 months ago

Overview

Description: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Source: psirt@paloaltonetworks.com
NVD status: Analyzed

Insights

Analysis from the Intruder Security Team

Published Nov 19, 2024

The vulnerabilities CVE-2024-0012 and CVE-2024-9474 can be combined to allow for an unauthenticated attacker to gain command line access to the vulnerable device. Compromising a vulnerable device would allow an attacker to gain access to internal networks as these devices are designed to sit on the edge of networks.

The vulnerability is due to a misconfigured Nginx instance and a command injection vulnerability, both of which are exploitable in the devices default state. Watchtowr have released a technical blog post detailing the vulnerability and its exploitation.

Palo Alto have released patches and hotfixes for the PAN-OS vulnerabilities, details are available here and here.

Risk scores

CVSS 4.0

Type: Secondary
Base score: 6.9
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red
Severity: MEDIUM

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Exploit added on: Nov 18, 2024
Exploit action due: Dec 9, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

Weaknesses

psirt@paloaltonetworks.com: CWE-78
nvd@nist.gov: CWE-78

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "19D52DC1-4441-4C88-B209-9B86FCC2162F",
            "versionEndExcluding": "10.1.14",
            "versionStartIncluding": "10.1.0"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7D294CCB-C898-444E-BD41-D423B96F8E23",
            "versionEndExcluding": "10.2.12",
            "versionStartIncluding": "10.2.0"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "47CBEECE-EA41-4A58-8AE9-D695C76D4019",
            "versionEndExcluding": "11.0.6",
            "versionStartIncluding": "11.0.0"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "413284AC-F55E-4037-90D4-D63A5FFC20C3",
            "versionEndExcluding": "11.1.5",
            "versionStartIncluding": "11.1.0"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E4D3A51-0A40-4B19-AAFC-A2484B1CF5D7",
            "versionEndExcluding": "11.2.4",
            "versionStartIncluding": "11.2.0"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B41A7115-A370-49E1-B162-24803E6DD2CB"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "65949A49-03A7-491C-B327-127F050AC4F6"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E8ACB147-B4C1-4964-B538-EAA117CC6DC1"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3D33A0FB-7538-42BF-84E8-7CCD7EEF9355"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FB95D77F-1263-4D47-A0BB-94A6DA937115"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B6C3AFF-3649-484C-A2FB-B71EE02FF176"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7B2C0E11-A6CE-419D-86A0-3930DE25B544"
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C01AD190-F3C2-4349-A063-8C5C78B725B9"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]