CVE-2024-0012 / CVE-2024-9474 — PAN-OS Authentication Bypass → Privilege Escalation Chain

When chained, these vulnerabilities allow unauthenticated remote code execution on the PAN-OS management web interface.

Both were actively exploited as zero-days in the wild under what has been tracked as Operation Lunar Peek. The research was initially disclosed by watchTowr.

Overview

The Palo Alto Networks PAN-OS management web interface is exposed to two critical flaws that, when combined, give an attacker full root-level access without any authentication:

1. CVE-2024-0012 — Bypass authentication controls and reach authenticated endpoints as an unauthenticated remote attacker.
2. CVE-2024-9474 — Once authenticated (even as a low-privilege user), escape the PHP session handler to write arbitrary files and escalate to root.

Technical Details

CVE-2024-0012 — Authentication Bypass

The management web interface improperly validates authentication for certain API and PHP endpoints. By manipulating HTTP request paths (e.g. path traversal or double-slash techniques), an attacker can reach restricted handlers that normally require a valid session. This effectively grants unauthenticated access to the PHPRESTAPI and other internal endpoints.

The root cause lies in the Nginx/Apache routing rules that fail to enforce session checks on specific URI patterns, allowing requests to bypass the authentication middleware.

CVE-2024-9474 — Privilege Escalation via PHP Session Write

Once authenticated (even as a read-only or low-privileged user), the vulnerability exists in the PHP session serialisation mechanism. The session.save_path is misconfigured, and the session filename is partially user-controlled. By crafting a session ID containing path-traversal sequences, an attacker can write a PHP session file to an arbitrary location (e.g. ../utils/webshell.php).

Because the web server runs as root, the written file inherits root ownership, giving the attacker a root-level webshell.

Affected Versions

Exploitation Chain

Attacker (unauthenticated)
    │
    ├─ CVE-2024-0012 ─────────────────────────────┐
    │  Bypass auth via crafted URI                  │
    │  → Gain access to PHPRESTAPI endpoint         │
    │  → Create a low-privilege API key / session   │
    └──────────────────────────────────────────────┘
    │
    ├─ CVE-2024-9474 ─────────────────────────────┐
    │  Use obtained session/key                     │
    │  → Send crafted PHP session ID (path traversal)│
    │  → Write session file to webroot              │
    │  → File contains PHP code (webshell)          │
    └──────────────────────────────────────────────┘
    │
    ▼
RCE as root via webshell

Reproduction Steps

1. Identify a vulnerable PAN-OS mgmt interface (port 443 by default).
2. CVE-2024-0012 — Send a crafted HTTP request to an internal endpoint using path manipulation to bypass auth. Receive an authenticated session token or API key.
3. CVE-2024-9474 — With the token, send a request to the session-handler endpoint with a malicious X-PAN- or cookie-based session ID containing ../ traversal to write a PHP payload to the web-accessible php/ directory.
4. Access the written webshell at /php/<shell>.php to execute arbitrary commands as root.

PoC

See exploit.py in this directory for a working proof-of-concept that chains both CVEs.

Mitigation

1. Upgrade PAN-OS to the hotfix versions listed in the affected-versions table.
2. Restrict the management interface to trusted internal IPs only — never expose it to the internet.
3. If the mgmt interface must be exposed, use a dedicated management VLAN or jump-box with strict ACLs.

References

• watchTowr — Operation Lunar Peek
• Palo Alto Networks Security Advisory — CVE-2024-0012
• Palo Alto Networks Security Advisory — CVE-2024-9474
• NVD — CVE-2024-0012
• NVD — CVE-2024-9474