CVE-2024-3400: Exploiting Palo Alto Networks PAN-OS — Patch Now

A critical CVE has been identified in Palo Alto Networks PAN-OS that allows for unauthenticated RCE. This vulnerability, tracked as CVE-2024-3400, carries a maximum CVSS score of 10.0, reflecting its potential for total system compromise. According to the SANS ISC Stormcast, the flaw resides in the GlobalProtect gateway and is exploitable only when both device telemetry and the GlobalProtect portal or gateway are enabled.

Technical Analysis of the Command Injection Flaw

The vulnerability is a classic command injection flaw triggered by insufficient input validation. Attackers exploit this by sending specially crafted requests to the GlobalProtect interface. When the system processes these requests for telemetry reporting, it fails to sanitize the input before passing it to a shell command. Because the service responsible for telemetry runs with elevated permissions, the injected commands are executed with root privileges.

Security researchers have observed that exploitation often involves a directory traversal component. Attackers can create arbitrary files on the system, which they then leverage to achieve persistent access. In many documented cases, threat actors have used this primitive to install custom backdoors or web shells in the /var/appweb/sslvpndocs/ directory. This allows for continued interaction with the compromised device even if the initial TTP is identified and blocked.

How to detect CVE-2024-3400 exploit activity in logs

Detection requires a multi-layered approach involving log analysis and filesystem integrity monitoring. Because the exploit manifests in the telemetry and GlobalProtect components, security teams should scrutinize the mp-log gpsvc.log and external_report.log files for unusual entries or shell command fragments.

Defenders should look for IoC patterns such as unexpected files in the web server’s document root or anomalous outbound connections to unknown IP addresses. Integrating these logs into a SIEM can provide real-time alerts for the command patterns associated with this vulnerability. Furthermore, advanced EDR solutions deployed on adjacent systems may identify Lateral Movement if the attacker attempts to pivot from the firewall into the internal network. Identifying the specific signatures of the command injection is the most effective way to confirm an attempt, as generic traffic analysis may overlook the obfuscated payloads used by sophisticated actors like Volt Typhoon.

Palo Alto Networks PAN-OS 11.1 mitigation steps

For organisations running Palo Alto Networks PAN-OS 11.1 mitigation steps must be prioritised to prevent exploitation. The primary recommendation is to update to the latest hotfix provided by the vendor (e.g., 11.1.2-h3 or later). If immediate patching is not feasible, the most effective workaround is to disable the device telemetry feature. Disabling telemetry prevents the vulnerable code path from being reached by the attacker’s requests.

Additionally, organisations with an active Threat Prevention subscription should ensure they have enabled Threat ID 95187, which provides specific signatures to block the known exploit vectors. It is also advisable to restrict access to the GlobalProtect interface to only trusted IP ranges where possible, reducing the attack surface. Security administrators should conduct a thorough audit of the filesystem for unauthorized files created during the window of vulnerability to ensure no persistence has been established.