The Palo Alto GlobalProtect vulnerability (CVE-2024-3400) is a command injection vulnerability in PAN-OS that allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall, specifically targeting devices with a GlobalProtect gateway or portal configured. The vulnerability can be exploited by manipulating the SESSID cookie value to create an empty file at an arbitrary path, whose name the device’s telemetry functionality later hands to a shell, potentially giving attackers full control of the firewall. The first advisory listed enabled telemetry as a precondition, but Palo Alto Networks’ advisory now states that device telemetry does not need to be enabled, so switching it off is no longer a mitigation. Volexity found the bug being exploited as a zero-day by a likely state-backed actor it tracks as UTA0218, which tested it from 26 March 2024 and deployed a Python backdoor called UPSTYLE on 10 April. CVE-2024-3400 affects PAN-OS versions 10.2, 11.0, and 11.1, and poses a significant risk to organizations using Palo Alto Networks firewalls.
