PT-2024-6884 · Palo Alto Networks · Palo Alto Networks Expedition

Hacks_Zach + 1 · Published 2024-10-09 · Updated 2024-11-16 · CVE-2024-9466

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition (affected versions not specified)

Description The issue is related to the cleartext storage of sensitive information in Palo Alto Networks Expedition, allowing an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. This can be exploited by a remote attacker to obtain encrypted user credentials. The vulnerability involves a flaw in the storage of sensitive information, potentially through registration files or logs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-532

CWE-312

Related Identifiers

BDU:2024-08107

CVE-2024-9466

Affected Products

Palo Alto Networks Expedition

References · 52

• 🔥 https://horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9466 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9466 · Vendor Advisory
• https://security.paloaltonetworks.com/PAN-SA-2024-0010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08107 · Security Note
• https://twitter.com/punitdarji28/status/1845753553765253576 · Twitter Post
• https://twitter.com/patchnow24x7/status/1844238096478634057 · Twitter Post
• https://twitter.com/Horizon3ai/status/1844069343044251918 · Twitter Post
• https://twitter.com/CROWDSTRIKEtech/status/1847065644472127855 · Twitter Post
• https://twitter.com/patchnow24x7/status/1844237974839623704 · Twitter Post
• https://twitter.com/Patrowl_io/status/1844381122966503832 · Twitter Post
• https://t.me/cvenotify/97697 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9466 · Note
• https://t.me/securixy_kz/1019 · Telegram Post
• https://twitter.com/bt0s3c/status/1844358298352361979 · Twitter Post