Palo Alto released the advisory for CVE-2024-5910 in July. The Horizon3.ai team set out to reproduce the vulnerability and discovered three vulnerabilities on the way.
They googled “palo alto expedition reset admin password” and found one forum post as a top result.
Based on that information the vulnerability only required a curl request to <SERVER>/OS/startup/restore/restoreAdmin.php to reset the admin password to paloalto.
Palo Alto fixed that one in Expedition 1.2.92.
Having a test system running, they discovered and reported three vulnerabilities:
- CVE-2024-9464: Authenticated Command Injection
- CVE-2024-9465: Unauthenticated SQL Injection
- CVE-2024-9466: Cleartext Credentials in Logs
All three are fixed in Expedition 1.2.96.