Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
volexity.com · 12 Apr 2024 · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2024-3400Palo Alto Networks PAN-OS Command Injection VulnerabilityPalo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter3 reports>99.9%Top 0.01%87.7priority
Where it names them
CVE-2024-3400 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
Through this cooperative investigation, the Palo Alto Networks PSIRT team was able to confirm the vulnerability as an OS command injection issue and assigned it CVE-2024-3400.
Palo Alto Networks has since issued an advisory for CVE-2024-3400 that includes information regarding a threat protection signature released to customers, as well as a timeline for a fix, which at the time of writing is expected April 14, 2024.
UTA0218 attempted to download and execute this file via the CVE-2024-3400 but was unsuccessful.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.