CVE-2020-2038: 
PAN-OS vulnerability analysis and mitigation

An OS Command Injection vulnerability (CVE-2020-2038) was discovered in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. The vulnerability affects multiple versions of PAN-OS including versions earlier than 9.0.10, 9.1.4, and 10.0.1 (Palo Alto).

The vulnerability is classified with a CVSS v3.1 Base Score of 7.2 (High), with attack vector being Network, attack complexity Low, requiring High privileges, and no user interaction needed. The vulnerability type is classified as CWE-78 (OS Command Injection). The issue exists in the management interface's operational mode command functionality, specifically in the ping request feature that runs as root on the server. The vulnerability allows injection of OS commands through insufficiently sanitized API requests (Palo Alto, AttackerKB).

If exploited, this vulnerability allows authenticated administrators to execute arbitrary OS commands with root privileges on the affected system. This level of access could potentially lead to complete system compromise, as root access to a firewall can severely impact an organization's security posture (Palo Alto).

The vulnerability requires authentication and high privileges for exploitation. Palo Alto Networks has acknowledged awareness of publicly available information that may help construct proof of concept exploits. A Metasploit module (exploit/linux/http/panos_op_cmd_exec) is available for this vulnerability (Palo Alto, AttackerKB).

The vulnerability has been fixed in PAN-OS versions 9.0.10, 9.1.4, 10.0.1, and all later versions. Until the PAN-OS software can be upgraded, organizations can enable signatures for Unique Threat ID 59954 on traffic destined for the GlobalProtect portal, gateway, or VPN to block attacks. Additionally, following best practices for securing the PAN-OS management web interface is recommended (Palo Alto).

The vulnerability was discovered and reported by Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies. Security researchers have noted this as a textbook command injection vulnerability, emphasizing its severity despite requiring authentication (AttackerKB).