CVE-2024-9466: 
Palo Alto Expedition vulnerability analysis and mitigation

A cleartext storage of sensitive information vulnerability (CVE-2024-9466) was discovered in Palo Alto Networks Expedition, affecting versions prior to 1.2.96. The vulnerability allows authenticated attackers to reveal firewall usernames, passwords, and API keys generated using those credentials. This security flaw was discovered by Zach Hanley of Horizon3.ai and was publicly disclosed on October 9, 2024 (Palo Advisory, Horizon3).

The vulnerability stems from improper handling of credentials during the migration process, where sensitive information is stored in cleartext in a world-readable file located at /home/userSpace/devices/debug.txt. This file contains raw request logs from the Expedition server when it exchanges cleartext credentials for API keys during device integration. The vulnerability has been assigned a CVSS score of 8.2 HIGH (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) (Palo Advisory, Horizon3).

The vulnerability exposes sensitive credentials including firewall usernames, passwords, and API keys that could be used to access and compromise connected Palo Alto Networks devices. While the Expedition server is designed to only store API keys and not retain cleartext credentials, the debug log file inadvertently preserves all credentials used in cleartext form (Security Online, Horizon3).

Palo Alto Networks has released version 1.2.96 which addresses this vulnerability. The cleartext file affected by CVE-2024-9466 will be removed automatically during the upgrade. After upgrading, administrators should rotate all Expedition usernames, passwords, and API keys, as well as all firewall usernames, passwords, and API keys that were processed by Expedition (Palo Advisory).