Full Report
Detect and mitigate critical vulnerabilities (CVE-2024-9463, CVE-2024-9464, CVE-2024-9465, CVE-2024-9466, CVE-2024-9467) in Palo Alto Networks’ Expedition tool. Organizations should patch urgently.
Analysis Summary
# Vulnerability: Multiple Critical Flaws in Palo Alto Networks Expedition Tool (Command Injection, SQLi, XSS)
## CVE Details
- CVE ID: CVE-2024-9463, CVE-2024-9464, CVE-2024-9465, CVE-2024-9466, CVE-2024-9467
- CVSS Score: Up to **9.9 (Critical)** (Based on CVE-2024-9463)
- CWE: OS Command Injection, SQL Injection, Sensitive Data Exposure, Cross-Site Scripting
## Affected Systems
- Products: Palo Alto Networks Expedition
- Versions: All versions of Expedition prior to **1.2.96**
- Configurations: Any configuration running the affected versions, particularly those exposed to the network.
## Vulnerability Description
This advisory covers five distinct vulnerabilities in the Palo Alto Networks Expedition configuration migration tool:
1. **CVE-2024-9463 & CVE-2024-9464 (OS Command Injection):** Allows both authenticated and unauthenticated attackers to execute arbitrary operating system commands with root privileges. This can lead to the exfiltration of sensitive credentials (like firewall credentials and API keys) and complete control over the affected system.
2. **CVE-2024-9465 (SQL Injection):** Permits unauthenticated attackers to interact with the underlying Expedition database, allowing retrieval of sensitive data such as password hashes and configuration details, and potentially enabling arbitrary file writes to the system.
3. **CVE-2024-9466 (Cleartext Storage of Sensitive Information):** Sensitive information is stored in cleartext within logs, increasing the risk of credential exposure during log analysis or access.
4. **CVE-2024-9467 (Reflected Cross-Site Scripting - XSS):** Allows attackers to inject malicious scripts via user input, primarily used to steal user sessions or execute phishing attacks against Expedition users.
## Exploitation
- Status: Exploitation details mention high risk, implying significant potential for exploitation, though the text does not explicitly confirm 'exploited in the wild' for all, the combination of high scores and minimal access requirements suggests high risk exploitation is likely.
- Complexity: **Low** (For key vulnerabilities, minimal complexity and no user interaction required for command injection/SQLi).
- Attack Vector: **Network** (For primary injection flaws).
## Impact
- Confidentiality: **High** (Exposure of credentials, hash, configurations).
- Integrity: **High** (Ability to write arbitrary files and execute commands as root).
- Availability: **High** (Potential for system disruption via command execution).
## Remediation
### Patches
- Upgrade Expedition to version **1.2.96 or later**.
### Workarounds
1. **Access Restrictions (Limiting Exposure):** Immediately limit network access to Expedition systems to only necessary, authorized personnel and internal networks.
2. **Shutdown Unused Instances:** If the Expedition software is not actively required, disable or shut down the instances to minimize the attack surface.
3. **Credential Rotation:** After upgrading, immediately rotate *all* related credentials, including usernames, passwords, and API keys associated with integrated firewalls and devices managed by Expedition.
## Detection
- **Indicators of Compromise (IoCs):**
* Inspect system access logs for HTTP requests targeting known vulnerable endpoints, specifically: `/OS/startup/restore/restoreAdmin.php` and `/bin/CronJobs.php`.
* Monitor the Expedition database for suspicious unauthorized queries or entries indicating file writes.
- **Detection Methods and Tools:**
* Security teams should utilize existing security monitoring tools to search logs for the suspicious endpoints mentioned above.
* Wiz customers can use the pre-built query and advisory within the Wiz Threat Center to quickly search for vulnerable instances.
## References
- PaloAlto's advisory: hxxps://security.paloaltonetworks.com/PAN-SA-2024-0010
- Horizon3's blog: hxxps://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/