CVE-2020-2008: 
PAN-OS vulnerability analysis and mitigation

An OS command injection and external control of filename vulnerability was discovered in Palo Alto Networks PAN-OS (CVE-2020-2008). The vulnerability allows authenticated administrators to execute code with root privileges or delete arbitrary system files, potentially impacting system integrity or causing denial of service conditions. The issue affects all versions of PAN-OS 7.1 and 8.0, as well as PAN-OS 8.1 versions earlier than 8.1.14. The vulnerability was discovered internally by Jin Chen of Palo Alto Networks and was published on May 13, 2020 (Palo Alto Networks).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the following characteristics: Network attack vector, Low attack complexity, High privileges required, No user interaction needed, and High impact on confidentiality, integrity, and availability. The weakness types associated with this vulnerability are CWE-73 (External Control of File Name or Path) and CWE-78 (OS Command Injection) (Palo Alto Networks).

The successful exploitation of this vulnerability could allow an authenticated administrator to execute code with root privileges, delete arbitrary system files, compromise system integrity, or cause denial of service conditions. The impact scope is rated as UNCHANGED, with HIGH impact ratings for confidentiality, integrity, and availability (Palo Alto Networks).

The vulnerability requires network access and high privileges (authenticated administrator access) to exploit, but has low attack complexity and requires no user interaction. The attack vector is through the management interface of PAN-OS (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS 8.1.14 and all later PAN-OS versions. For affected systems, Palo Alto Networks strongly recommends following best practices for securing the PAN-OS management interface. The issue affects the management interface of PAN-OS and can be mitigated by implementing best practices for securing administrative access, which are available in the PAN-OS technical documentation (Palo Alto Networks).