CVE-2024-3400 Vulnerability
Description
The CVE-2024-3400 vulnerability is a security vulnerability that affects PAN-OS firewalls in versions 10.2, 11.0, and 11.1. This vulnerability is exploited when GlobalProtect gateway and device telemetry configurations are enabled. An attacker can leverage this vulnerability to execute malicious commands and compromise system security.
Technical Details
- CVE: CVE-2024-3400
- Affected Products: PAN-OS Firewalls versions 10.2, 11.0, and 11.1
- Impact: Remote command execution, system security compromise.
Steps to Reproduce
- Ensure that GlobalProtect gateway and device telemetry configurations are enabled on the PAN-OS firewall. or Prepare the environment with https://github.com/CerTusHack/CVE-2024-3400-PoC
- Send a GET web request to a specific endpoint that triggers the vulnerability.
- Inject a malicious command (such as an XSS script) into the GET request to exploit the vulnerability.
- The PAN-OS firewall will process the request and execute the malicious command.
- The attacker can gain remote access to the system and compromise its security.
USAGE
It's simple: clone this repository, run menu.py and follow each step. All of this comes with this explanation:

Mitigation
To mitigate this vulnerability, the following is recommended:
- Update the PAN-OS firewall firmware to a patched version that fixes this vulnerability.
- Disable GlobalProtect gateway and device telemetry configurations if not needed for your environment.
- Perform regular security audits to detect and correct potential vulnerabilities.
References
Contribution
If you have additional information about this vulnerability or ways to mitigate it, feel free to contribute to this repository via pull requests.