Palo Alto Networks · PAN-OS
A command injection flaw, arising from arbitrary file creation, exists in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations. An unauthenticated attacker with network access could exploit it, without user interaction, to execute arbitrary code with root privileges on the firewall.
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Unauthenticated exploit of internet-facing GlobalProtect portal
may enable an unauthenticated attacker to execute arbitrary code
Command injection yields arbitrary code execution
A command injection as a result of arbitrary file creation vulnerability
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2024-3400 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Palo Alto Networks has since issued an advisory for CVE-2024-3400 that includes information regarding a threat protection signature released to customers, as well as a timeline for a fix, which at the time of writing is expected April 14, 2024.
4 passages name itOriginal (opens in a new tab) ↗
CVE-2024-3400 - Palo Alto Networks PAN-OS GlobalProtect arbitrary file creation leading to OS command injection.
Their intelligence revealed a critical vulnerability—CVE-2024-3400—impacting Palo Alto Networks firewall appliances running an outdated PAN-OS software.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.