cve-2024-3400-panos_rce_reproduction

Reproduction of cve-2024-3400-panos_rce_reproduction

Specifically, an unauthenticated HTTP request to the GlobalProtect portal endpoint (/global-protect/login.esp) with a crafted SESSID cookie containing embedded shell metacharacters (backticks and variable expansion) results in command injection.

Injection Mechanism

The vulnerable code path operates as follows:

1. The GlobalProtect portal receives a request to /global-protect/login.esp
2. The SESSID cookie value is extracted without sanitization
3. This value is interpolated into a shell command string
4. The command is executed via system() or similar OS command execution function
5. Because the application runs as root, the injected command executes with full system privileges

Payload Construction

The injection payload uses backtick-delimited commands within the SESSID cookie:

The path traversal (/../../../) breaks out of the intended directory, and the backtick-quoted COMMAND portion causes the shell to execute the attacker's input. Output redirection or reverse shell mechanisms can be used to exfiltrate command results.

Affected Versions

Note: PAN-OS 9.x and earlier are not affected. Cloud NGFW and Prisma Access are not affected.

Exploitation

Attack Vector

• Network: Remote
• Authentication: None required
• Privilege Required: None
• User Interaction: None
• Impact: Complete compromise of confidentiality, integrity, and availability

Observed Threat Actor Activity

UNC4554 / Midnight Blizzard (APT29) was observed exploiting CVE-2024-3400 as a 0-day beginning in March 2024. Volexity published their analysis on April 12, 2024. Attack patterns included:

1. Initial Access: Mass scanning for exposed GlobalProtect portals
2. Command Execution: Deploying custom Python backdoors via the cookie injection vector
3. Persistence: Installing UPSTYLE backdoor, credential theft, configuration extraction
4. Lateral Movement: Using compromised firewalls as footholds into internal networks
5. Data Exfiltration: Stealing configuration files, VPN credentials, and session tokens
6. Ransomware: Multiple incidents of ransomware deployment following initial compromise

Proof-of-Concept Availability

Multiple public PoCs have been released. This repository provides a functional exploit for authorized testing.

Reproduction Steps

Requirements

• Python 3.8+
• requests library
• Target: Palo Alto PAN-OS with a vulnerable GlobalProtect portal exposed
• Authorized access only

Setup

Basic Exploit

Reverse Shell Example

Arbitrary File Read

Proof-of-Concept (curl)

PoC Script

See exploit.py in this repository for a fully-featured Python exploit supporting:

• Arbitrary command execution
• Optional proxy support (Burp Suite / mitmproxy)
• SSL verification control
• Timeout and retry handling
• Response analysis

Detection

IOCs

• Requests to /global-protect/login.esp with abnormally long or suspicious SESSID cookies
• Cookies containing path traversal sequences (/../../) combined with backtick characters
• Unexpected processes spawned by the GlobalProtect component
• Outbound connections from the firewall to unknown IP addresses on unusual ports
• Files written to /opt/panlogs/tmp/device_telemetry/ with .py extensions

Sigma Rule (Simplified)

Mitigation

Immediate Actions

1. Update PAN-OS to the fixed versions listed above
2. If immediate patching is not possible, apply one of the following workarounds:
   • Device Telemetry Disable: set deviceconfig system telemetry disable yes (blocks the vulnerable code path without requiring a reboot)
   • GlobalProtect Portal/Gateway Access Control: Restrict access to trusted source IPs
3. Scan for compromise: Check for unauthorized files in /opt/panlogs/tmp/device_telemetry/
4. Review logs: Audit GlobalProtect login logs for anomalous SESSID cookie values

Permanent Fix

Apply the hotfix provided by Palo Alto Networks. The fix properly sanitizes cookie input before shell command construction.

Compromise Assessment

If you suspect exploitation:

1. Collect forensic images of affected firewalls
2. Audit all configuration changes (last-modified timestamps)
3. Review running processes and cron jobs
4. Check for unauthorized SSH keys and user accounts
5. Rotate all VPN credentials and shared secrets
6. Inspect network traffic for C2 communication patterns

References

Disclaimer

This repository is provided for authorized security testing and educational purposes only. Unauthorized exploitation of this vulnerability is illegal. The authors are not responsible for misuse of this information. Always ensure you have explicit written permission before testing any system.

License

MIT License - This content is provided for defensive security research and authorized testing.