IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Big zero-day flaw found in Palo Alto security appliance

Vulnerability in GlobalProtect VPN could enable hackers to take control of the security system

Palo Alto Networks sign at the Company headquarters in Silicon Valley

Security researchers have said that a zero-day flaw in a security appliance from Palo Alto Networks could affect around 10,000 servers running the product.

Researchers at cyber security firm Randori said that flaw, tracked as CVE-2021-3064, affected PAN firewalls using the GlobalProtect Portal VPN and allowed for unauthenticated remote code execution on vulnerable product installations.

They added that the problem affected multiple versions of PAN-OS 8.1 before 8.1.17. Researchers found numerous vulnerable instances exposed on internet-facing assets, more than 10,000 assets.  

“Our team was able to gain a shell on the affected target, access sensitive configuration data, extract credentials, and more. Once an attacker has control over the firewall, they will have visibility into the internal network and can proceed to move laterally,” said researchers.

Researchers developed a reliable working exploit and leveraged the capability as part of their red team products. The flaw was discovered over a year ago.

The bug is a buffer overflow that occurs while parsing user-supplied input into a fixed-length location on the stack. The problematic code is not reachable externally without using an HTTP-smuggling technique, according to researchers.

They added that the exploitation of these together yields remote code execution under the privileges of the affected component on the firewall device. “The smuggling capability was not designated a CVE identifier as it is not considered a security boundary by the affected vendor,” added researchers.

An attacker must have network access to the device on the GlobalProtect service port (default port 443) to exploit this vulnerability. As the affected product is a VPN portal, this port is often accessible over the internet, said researchers.

Exploitation is difficult but possible on devices with ASLR enabled, which is the case in most hardware devices. On virtualized devices — VM-series firewalls — exploitation is significantly easier due to lack of ASLR and Randori expects public exploits will surface.

“Randori researchers have not exploited the buffer overflow to result in controlled code execution on certain hardware device versions with MIPS-based management plane CPUs due to their big-endian architecture, though the overflow is reachable on these devices and can be exploited to limit availability of services,” they added.

The company said to avoid enabling misuse of the flaw, it will withhold the technical details related to CVE-2021-3064 from public dissemination for 30 days after the publication of the blog post on the subject.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022
How do you become an ethical hacker?
ethical hacking

How do you become an ethical hacker?

29 Apr 2022
What is phishing?
phishing

What is phishing?

29 Apr 2022

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
How full-stack observability can accelerate IT innovation
Sponsored

How full-stack observability can accelerate IT innovation

3 May 2022