loanvitor/cve-2024-3400-Go-based exploit for CVE-2024-3400, enabling unauthenticated remote code execution on PAN-OS firewalls via command injection in GlobalProtect. Supports single-target and CSV batch attacks.
This repository contains a Go script that exploits a Command Injection vulnerability in firewalls running Palo Alto Networks' PAN-OS operating system. The vulnerability, identified as CVE-2024-3400, allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
CVE-2024-3400 is a critical vulnerability affecting multiple versions of PAN-OS, including PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1, when configured with the GlobalProtect Gateway and/or GlobalProtect Portal features and device telemetry enabled. Successful exploitation of this vulnerability can result in the execution of arbitrary code on the firewall, potentially leading to complete compromise of the device.
The script in this repository is developed for educational and research purposes, aiming to demonstrate how the vulnerability can be exploited. It allows users to perform attacks against vulnerable PAN-OS firewalls by injecting custom payloads into them.
The script can be run in two ways: by entering values directly or by using a CSV file containing a list of targets. Here's how to use it:
go run exploit.go.go run exploit.go.