CVE-2020-2004: 
Palo Alto Networks GlobalProtect Agent vulnerability analysis and mitigation

CVE-2020-2004 affects the GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows, where user passwords may be logged in cleartext in the PanGPS.log diagnostic file under specific conditions. The vulnerability was discovered internally by Palo Alto Networks and disclosed on May 13, 2020. The affected versions include GlobalProtect app 5.0 versions earlier than 5.0.9 and GlobalProtect app 5.1 versions earlier than 5.1.2 on Windows or MacOS platforms (Palo Alto Advisory).

The vulnerability occurs when three specific conditions are met: (1) 'Save User Credential' option is set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalProtect user manually selects a gateway, and (3) the logging level is set to 'Dump' while collecting troubleshooting logs. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.8 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L. The weakness is classified as CWE-534 (Information Exposure Through Debug Log Files) (Palo Alto Advisory).

The vulnerability could lead to exposure of user credentials in cleartext within the PanGPS.log diagnostic file. While the GlobalProtectLogs zip files were only accessible by authorized personnel with valid Palo Alto Networks credentials, the exposure of passwords in log files presents a security risk. Palo Alto Networks has confirmed they have no evidence of malicious access or use of these credentials (Palo Alto Advisory).

Multiple mitigation options are available: 1) Do not set the 'Logging Level' option to 'Dump' while collecting troubleshooting logs (the issue does not occur when set to 'Debug'), 2) Set the 'Save User Credential' option to 'No' in the GlobalProtect Portal's Agent configuration, or 3) Use Single-Sign-On (SSO) feature instead of the 'Save User Credential' option. The vulnerability has been fixed in GlobalProtect app versions 5.0.9, 5.1.2, and all later versions (Palo Alto Advisory).