CVE-2024-3388: 
PAN-OS vulnerability analysis and mitigation

A vulnerability (CVE-2024-3388) was discovered in the GlobalProtect Gateway component of Palo Alto Networks PAN-OS software. The vulnerability was disclosed on April 10, 2024, and affects multiple versions of PAN-OS and Prisma Access. This security flaw enables an authenticated attacker to impersonate another user and send network packets to internal assets, though the attacker cannot receive response packets from those internal assets (Palo Alto Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 5.0 (MEDIUM) according to NIST, with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. It is categorized under CWE-269 (Improper Privilege Management) and CWE-863 (Incorrect Authorization). The issue specifically affects configurations where GlobalProtect gateway is enabled and SSL VPN is either permitted as a fallback or configured as the only available tunnel mode (NVD, Palo Alto Advisory).

The vulnerability allows authenticated attackers to impersonate other users and send network packets to internal assets within the affected network. However, the impact is limited as attackers cannot receive response packets from the internal assets they target (Palo Alto Advisory).

As of the disclosure, Palo Alto Networks has stated they are not aware of any malicious exploitation of this vulnerability in the wild (Palo Alto Advisory).

The vulnerability has been fixed in PAN-OS versions 8.1.26, 9.0.17-h4, 9.1.17, 10.1.11-h4, 10.2.7-h3, 11.0.3, and all later versions, as well as in Prisma Access 10.2.4 and later. As a workaround, administrators can enable the 'Disable Automatic Restoration of SSL VPN' option in the Network > GlobalProtect Gateways > GlobalProtect Gateway Configuration > Agent > Connection Settings on PAN-OS firewalls (Palo Alto Advisory).