greaselovely/cve-2024-0012PANW NGFW CVE-2024-0012
This Python script checks for the presence of a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS Management Web Interface, identified as CVE-2024-0012. The vulnerability enables an unauthenticated attacker to gain administrative privileges, tamper with configuration, or exploit other privilege escalation vulnerabilities.
Zero Touch Provisioning and window.Pan for accurate detection.-t or a file of targets with -f.-d argument or via user prompt in interactive mode.-e or --explanation to print a detailed, user-friendly description of CVE-2024-0012 and CVE-2024-9474rich library to display results in a clean, human-readable format.requests library for HTTP requestsrich library for styled outputpip install -r requirements.txt
To check a single target interactively:
python main.py
Specify a single FQDN or IP:
python main.py -t 127.0.0.1
Provide a file containing a list of targets (one per line):
python main.py -f targets.txt
Use the -d or --details flag to automatically print detailed results for all vulnerable targets:
python main.py -t 127.0.0.1 -d
Use the -e or --explanation flag to print a detailed explanation of CVE-2024-0012 and CVE-2024-9474 vulnerabilities:
python main.py -t 127.0.0.1 -d -e (or -de)
[!] Target -appears- vulnerable!
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Key ┃ Value ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
┃ URL ┃ https://127.0.0.1/php/ztp_gate.php/.js.map ┃
┃ Status Code ┃ 200 ┃
┃ Headers ┃ {"Date": "Wed, 20 Nov 2024 15:29:31 GMT", ... ┃
┃ Markers Found ┃ ...<title>Zero Touch Provisioning</title>... ┃
┃ ┃ ...window.Pan = window.Pan || {};... ┃
└─────────────────────────────┴──────────────────────────────────────────────────────────┘
[+] Target does not appear to be vulnerable.
Message: No matching conditions met.
At the end of the scan, a summary table lists all targets and their statuses:
┏━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Target ┃ Status ┃
┡━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━┩
┃ 127.0.0.1 ┃ Vulnerable ┃
┃ example.com ┃ Not Vulnerable ┃
└───────────────────────┴─────────────────┘
If the -e or --explanation flag is used:
CVE-2024-0012 Explained
CVE-2024-0012 is an authentication bypass vulnerability. This means attackers can skip the login process and access sensitive parts of a system without needing a username or password. In Palo Alto Networks’ PAN-OS, this vulnerability allows attackers to trick the system by sending specially crafted HTTP GET requests. These requests include a header called `X-PAN-AUTHCHECK`, which tells the system whether or not authentication is required. If this header is set to `off`, the system mistakenly grants access to restricted areas without checking if the person is logged in.
This vulnerability can be exploited together with CVE-2024-9474, a privilege escalation vulnerability, to gain full root access to the device. Once attackers achieve root access, they can control the firewall, steal sensitive data, or disable security features.
If this vulnerability is confirmed, patch the affected system as soon as possible to prevent exploitation. Additionally, restrict access to the management interface by IP whitelisting or using a dedicated management network.
[bold red]Error:[/bold red] HTTPSConnectionPool(host='127.0.0.1', port=443): Max retries exceeded with URL: /php/ztp_gate.php/.js.map (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x...>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed'))
--target or --file argument is provided, the script prompts for interactive input.-e flag provides an educational overview of the vulnerabilities for users who need more context.This script is released under the MIT License. See LICENSE file for details.
This script is provided "as-is" without warranty of any kind. Use at your own risk. The author is not responsible for any damage caused by the use of this tool.
This script was inspired by the brilliant work of the watchTowr team, whose original Nuclei YAML template for CVE-2024-0012 served as the foundation for this Python implementation. Their dedication to identifying and addressing critical security vulnerabilities continues to set a high standard in the cybersecurity community.