PT-2024-7800 · Microsoft+1 · Windows+1

Marc Barrantes + 1 · Published 2024-10-03 · Updated 2024-10-17 · CVE-2024-9473

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect App versions prior to 6.2.5

Description A privilege escalation issue in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install GlobalProtect.

Recommendations Update to version 6.2.5 to resolve the issue. As a temporary workaround, consider disabling the repair functionality offered by the .msi file used to install GlobalProtect until a patch is available. Restrict access to the .msi file used to install GlobalProtect to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2024-09300

CVE-2024-9473

Affected Products

Palo Alto Networks Globalprotect

Windows

References · 18

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-palo-alto-networks-globalprotect · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9473 · Security Note
• https://security.paloaltonetworks.com/CVE-2024-9473 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9473 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09300 · Security Note
• https://t.me/cvedetector/7504 · Telegram Post
• https://vulners.com/cvelist/CVELIST:CVE-2024-9473 · Note
• https://twitter.com/the_yellow_fall/status/1844195518018355309 · Twitter Post
• https://t.me/cvenotify/98171 · Telegram Post
• https://t.me/cybersecuritytechnologies/11267 · Telegram Post
• https://twitter.com/3cSoc/status/1844356337611964752 · Twitter Post
• https://vuldb.com/?id.279903 · Note
• https://twitter.com/ksg93rd/status/1845094363728068798 · Twitter Post
• https://t.me/pentestingnews/52219 · Telegram Post
• https://packetstormsecurity.com/files/182142 · Note