PT-2019-2796 · Palo Alto · Pan-Os

Meh Chang + 1 · Published 2019-07-18 · Updated 2025-11-04 · CVE-2019-1579

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1.18 and earlier PAN-OS versions 8.0.11-h1 and earlier PAN-OS versions 8.1.2 and earlier

Description The issue exists due to insufficient input validation in the GlobalProtect portal and GlobalProtect Gateway interface of the PAN-OS operating system. Exploitation of this issue may allow an unauthenticated remote attacker to execute arbitrary code by sending a specially crafted request. Mass scanning activity has been detected, checking for vulnerable Palo Alto SSL VPN servers. Successful exploitation allows an unauthenticated attacker to execute arbitrary code.

Recommendations For PAN-OS versions 7.1.18 and earlier, update to a version later than 7.1.18. For PAN-OS versions 8.0.11-h1 and earlier, update to a version later than 8.0.11-h1. For PAN-OS versions 8.1.2 and earlier, update to a version later than 8.1.2. As a temporary workaround, consider disabling the GlobalProtect Portal or GlobalProtect Gateway Interface until a patch is available. Restrict access to the GlobalProtect portal and GlobalProtect Gateway interface to minimize the risk of exploitation.

Exploit

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-20

CWE-134

Related Identifiers

BDU:2019-02748

BDU:2019-02750

CVE-2019-1579

Affected Products

Pan-Os

References · 23

• 🔥 https://github.com/securifera/CVE-2019-1579 · Exploit
• 🔥 https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study · Exploit
• https://security.paloaltonetworks.com/CVE-2019-1579 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02748 · Security Note
• https://bdu.fstec.ru/vul/2019-02750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1579 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1579 · Vendor Advisory
• https://t.me/canyoupwnme/5882 · Telegram Post
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Note
• https://t.me/defcon_news/24455 · Telegram Post
• https://t.me/ckure/5420 · Telegram Post
• http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html · Note
• https://t.me/rnetsec/10398 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579 · Note
• https://t.me/thehackernews/604 · Telegram Post