Critical Palo Alto Networks Expedition bug exploited (CVE-2024-5910)
A vulnerability (CVE-2024-5910) in Palo Alto Networks Expedition, a firewall configuration migration tool, is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Thursday.
About CVE-2024-5910
Unearthed and reported by Brian Hysell of Synopsys Cybersecurity Research Center (CyRC), CVE-2024-5910 stems from missing authentication for a critical function, which can lead to an Expedition admin account takeover for attackers with network access to the installation.
A security update fixing the vulnerability has been provided by Palo Alto Networks in July 2024. The company also advised those who couldn’t upgrade to make sure network access to their Expedition installation is restricted to authorized users, hosts, or networks.
The public disclosure of CVE-2024-5910 has spurred Horizon3.ai researchers to disclose (three months later) that the vulnerability could be exploited by sending a simple request to an exposed endpoint to reset the admin password:
Reseting the admin password (Source: Horizon3.ai)
They also decided to probe the tool for further weaknesses, and they found three:
- CVE-2024-9464: An authenticated command injection
- CVE-2024-9465: An unauthenticated SQL injection
- CVE-2024-9466: Cleartext credentials in logs
Fixes for those vulnerabilities have been released in October 2024. But proof-of-concept exploit code for chaining the flaw with CVE-2024-9464 to achieve “unauthenticated” arbitrary command execution on vulnerable Expedition servers is publicly accessible.
What to do?
Whether CVE-2024-5910 is being exploited by itself or in conjunction with another vulnerability is unknown, because CISA didn’t share that information.
Palo Alto Networks has updated the advisory to say that they are “aware of reports from CISA that there is evidence of active exploitation for this CVE.”
If they haven’t already, users should upgrade their Expedition installation to a fixed version and make sure it is not exposed to the internet (as there is no reason for it).
Next, they should rotate all Expedition usernames, passwords, and API keys, as well as all firewall usernames, passwords, and API keys processed by Expedition.
Horizon3.ai’s Zach Hanley has previously explained how to check for indicators of compromise.
UPDATE (November 12, 2024, 11:25 a.m. ET):
“Censys has identified 45 publicly exposed Expedition instances. Note that not all of these are necessarily vulnerable, as specific device versions are not available,” the company has shared.