PT-2024-6883 · Palo Alto Networks · Palo Alto Networks Expedition

Enrique Castillo + 2 · Published 2024-10-09 · Updated 2024-11-20 · CVE-2024-9464

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition (affected versions not specified)

Description An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition. This results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. The vulnerability is related to the failure to neutralize special elements used in the OS command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-08106

CVE-2024-9464

Affected Products

Palo Alto Networks Expedition

References · 70

• 🔥 https://github.com/horizon3ai/CVE-2024-9464 · Exploit
• 🔥 https://horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise · Exploit
• https://bdu.fstec.ru/vul/2024-08106 · Security Note
• https://cve.org/ReportRequest/ReportRequestForNonCNAs#UpdateCVERecord · Security Note
• https://security.paloaltonetworks.com/PAN-SA-2024-0010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9464 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9464 · Vendor Advisory
• https://twitter.com/CROWDSTRIKEtech/status/1847065644472127855 · Twitter Post
• https://twitter.com/Raj_Samani/status/1859159116406563065 · Twitter Post
• https://twitter.com/S0ufi4n3/status/1844310544653930853 · Twitter Post
• https://t.me/securixy_kz/1019 · Telegram Post
• https://twitter.com/CveFindCom/status/1844068251791167950 · Twitter Post
• https://twitter.com/akaclandestine/status/1846101177391268251 · Twitter Post
• https://twitter.com/ksg93rd/status/1845850644004966786 · Twitter Post
• https://twitter.com/patchnow24x7/status/1844238255006548067 · Twitter Post