CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
- Published
- Apr 12, 2024
- Updated
- Oct 21, 2025
- Assigning CNA
- palo_alto
- Evidence observed
- Apr 12, 2024
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Sources
modules/exploits/linux/http/panos_telemetry_cmd_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/panos_telemetry_cmd_exec.platform)
- verification: check_declared($.exploit_linux/http/panos_telemetry_cmd_exec.check)
http/cves/2024/CVE-2024-3400.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- CVE-2024-3400Exploit
Global Protec Palo Alto File Write Exploit
- CVE-2024-3400Exploit
Proof-of-concept exploit for CVE-2024-3400, a command injection in Palo Alto GlobalProtect. Scans targets, triggers RCE, and retrieves configuration files for unauthorized access.
- CVE-2024-3400Exploit
Python script to detect and exploit CVE-2024-3400 arbitrary file upload vulnerability in Palo Alto Networks firewalls by checking status codes and creating test files.
Python script to test for CVE-2024-3400 RCE in Palo Alto GlobalProtect by sending crafted cookies with base64-encoded commands and analyzing responses.
Detection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs, exploit patterns, and mitigation guidance.
Proof-of-concept exploit for CVE-2024-3400, a command injection vulnerability in Palo Alto firewalls, demonstrating file creation and remote command execution via crafted HTTP requests.
Proof-of-concept exploit for CVE-2024-3400, a Palo Alto OS command injection in GlobalProtect VPN. Demonstrates file creation and outbound command execution via crafted HTTP requests.
CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect
- CVE-2024-3400-CheckerScanner
A check program for CVE-2024-3400, Palo Alto PAN-OS unauthenticated command injection vulnerability. Palo Alto 防火墙 PAN-OS 远程命令注入检测程序。
- cve-2024-3400Exploit
Python exploit and checker script for CVE-2024-3400 Palo Alto Command Injection and Arbitrary File Creation
- CVE-2024-3400-Exploit
Go-based exploit for CVE-2024-3400, enabling unauthenticated remote code execution on PAN-OS firewalls via command injection in GlobalProtect. Supports single-target and CSV batch attacks.
- CVE-2024-3400Exploit
Exploit for GlobalProtect CVE-2024-3400
- CVE-2024-3400Exploit
Proof-of-concept exploit for CVE-2024-3400, demonstrating command injection in Palo Alto PAN-OS with a Python-based backdoor, persistence via system.pth, and CSS file manipulation for covert C2.
- CVE-2024-3400-Compromise-CheckerDetection
A simple bash script to check for evidence of compromise related to CVE-2024-3400
- Global-Protect_VPN_VulnScanner
Testing a List of IP address incase they are vulnerable to CVE-2024-3400
- CVE-2024-3400Scanner
Finding Palo Alto devices vulnerable to CVE-2024-3400.
CVE-2024-3400 POC written in Rust and Python
Reproduction of cve-2024-3400-panos_rce_reproduction
CVE-2024-3400 : Palo Alto OS Command Injection - POC
- CVE-2024-3400Exploit
Nuclei template and bash script for detecting and exploiting CVE-2024-3400 command injection in Palo Alto PAN-OS GlobalProtect, enabling unauthenticated root-level code execution.
CTT-PAN-OS-Exploit – CVE-2024-3400 (CVSS 10.0) with Convergent Time Theory enhancement. Uses α = 0.0302011 temporal dispersion, 33-layer phase resonance cascade, and 11 ns temporal wedge filtering to exploit Palo Alto GlobalProtect command injection. The payload is distributed across 33 temporal layers with exponential priority d
- CVE-2024-3400Detection
Python script to check Palo Alto firewalls for CVE-2024-3400 exploit attempts
- CVE-2024-3400-CheckScanner
Python script to check for CVE-2024-3400 vulnerability in Palo Alto Networks PAN-OS SSL VPN by probing /ssl-vpn/hipreport.esp and verifying file access via /global-protect/portal/images/sxy.txt.
- CVE-2024-3400-RCE-ScanScanner
CVE-2024-3400-RCE
- CVE-2024-3400Exploit
Multi-threaded exploit tool for CVE-2024-3400 in Palo Alto PAN-OS with automated artifact download and detailed logging for confirmed RCE.
- CVE-2024-3400Exploit
Exploit script for CVE-2024-3400, a command injection in PAN-OS GlobalProtect, allowing unauthenticated remote code execution with root privileges. Supports single and CSV-based multi-target exploitation.
- CVE-2024-3400Exploit
CVE-2024-3400
Proof-of-concept exploitation steps for CVE-2024-3400, demonstrating unauthenticated command injection in Palo Alto GlobalProtect via crafted cookie and form parameters.
- CVE-2024-3400Scanner
CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect
Sets up a Docker-based Palo Alto firewall test environment and provides an exploit script to test CVE-2024-3400, enabling safe vulnerability validation.
Proof-of-concept exploit for CVE-2024-3400, a critical OS command injection vulnerability in GlobalProtect Gateway, enabling remote code execution with severity score 10/10.
Exploit for CVE-2024-3400, providing proof-of-concept code to demonstrate and test the vulnerability in affected systems.
- CVE-2024-3400Exploit
Vulnerabilidad de palo alto
Simple POC for CVE-2024-3400
Attempt at making the CVE-2024-3400 initial exploit (for educational purposes)
- cs50-cyber-paloalto-oauthResearch
CS50 Cybersecurity final project — Palo Alto OAuth token breach (CVE-2024-3400)
Have we not learnt from HoneyPoC?
CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.
Kr0ff · linux_x86-64 · Apr 21, 2024
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.