In this article watchTowr Labs examines two critical vulnerabilities in Palo Alto Networks’ PAN-OS.
CVE-2024-0012 is an authentication bypass in the management web interface.
By adding the header X-PAN-AUTHCHECK: off and abusing a proxypass rule, attackers can access the management web interface.
CVE-2024-9474 is a privilege escalation vulnerability that was chained with the above.
A vulnerability in createRemoteAppwebSession.php allows attackers to create arbitrary users with arbitrary roles and assigns a PHP session ID used as an authentication token.
Attackers can then upload their malicious PHP code using the PHP session ID and execute commands in the vulnerable products with root privileges.
One noteworthy line from the article to close this topic.
Enterprise-grade security appliances that everyone trusts to secure their communications and internal networks