CVE-2024-0012: 
PAN-OS Schwachstellenanalyse und -minderung

An authentication bypass vulnerability (CVE-2024-0012) was discovered in Palo Alto Networks PAN-OS software, affecting versions 10.2, 11.0, 11.1, and 11.2. The vulnerability was disclosed on November 18, 2024, and enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. This issue affects PA-Series, VM-Series, and CN-Series firewalls and Panorama devices, while Cloud NGFW and Prisma Access are not impacted (Palo Advisory).

The vulnerability stems from an improper implementation of authentication checks in the Nginx configuration, where attackers can bypass authentication by supplying the 'X-PAN-AUTHCHECK: off' header in requests to protected endpoints. The vulnerability has a CVSS v4.0 base score of 9.3 (CRITICAL) and a CVSS v3.1 base score of 9.8, indicating its severe nature. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) (Watchtowr Labs).

Successful exploitation allows attackers to perform administrative actions, tamper with device configurations, and potentially exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474. The impact is particularly severe for devices with management interfaces exposed to untrusted networks or the internet (Palo Advisory).

Palo Alto Networks has confirmed an increasing number of attacks leveraging this vulnerability, with proof-of-concept exploits being publicly disclosed. The exploitation primarily originates from IP addresses associated with anonymous VPN services. Post-exploitation activities have included interactive command execution and deployment of web shells (Unit42 Brief).

Palo Alto Networks has released fixes in PAN-OS versions 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, and 11.2.4-h1. The primary mitigation recommendation is to restrict management interface access to trusted internal IP addresses only. Additional protection can be achieved by using Threat Prevention subscription with Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763 in block mode. For compromised devices, Palo Alto Networks recommends taking the device offline and performing an Enhanced Factory Reset (Palo Advisory).

The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog, with a remediation due date of December 9, 2024. CISA recommends either applying vendor mitigations or discontinuing use of the product if mitigations are unavailable (NVD).