CVE-2024-3400 — Palo Alto GlobalProtect command injection

CVE-2024-3400 — Palo Alto GlobalProtect command injection

TL;DR: A pre-authentication OS command injection in Palo Alto PAN-OS GlobalProtect VPN allowed unauthenticated attackers to execute arbitrary commands with root privilege on the firewall. The bug was a session-id cookie used as a filename component without sanitisation. Volexity discovered exploitation in the wild before patch availability. Mass-exploited as an n-day after disclosure. A textbook edge-appliance pre-auth chain with classic command-injection root cause. Companion to cve-2024-21762-fortios-out-of-bounds and command-injection.

Why this matters

  • Disclosed as a zero-day — exploited before patch.
  • Pre-auth on the GlobalProtect portal — internet-facing on millions of PAN-OS devices.
  • Root cause is trivial (a filename derived from a header).
  • Defines the modern “edge appliance shouldn’t trust its own log path” lesson.

The bug class

Command injection via filename. Specifically: PAN-OS GlobalProtect’s telemetry component creates a file using a string derived from the SESSID cookie. The string was concatenated into a shell-invoked path. By placing shell metacharacters in the cookie, the attacker injected commands.

The pseudo-shape:

1
2
3

cookie = headers["Cookie"]["SESSID"]
filename = f"/var/.../{cookie}"
os.system(f"some_command {filename}")

The cookie wasn’t validated. Injecting `cmd` (backtick), $(cmd), or ; cmd ran attacker commands.

The patch shape

The fix added input validation (regex restricting cookie character set) and switched to subprocess-style argument passing instead of os.system.

Two lessons from one patch:

  1. Validate any string that enters a shell.
  2. Don’t use shell-quoting interfaces when you can pass a list of arguments to exec instead.

Exploitation in the wild

Volexity observed the bug exploited weeks before disclosure. Attackers (tracked as UTA0218) deployed:

  • A custom Python backdoor named “UPSTYLE”.
  • Used the firewall to pivot inward, dump credentials, and exfiltrate.
  • Used legitimate management commands to blend.

Post-disclosure, ransomware groups and other operators rapidly weaponised.

Workflow to reproduce in a lab

  1. Acquire a vulnerable PAN-OS image (community archives).
  2. Spin up in PA-VM (virtual firewall) form.
  3. Enable GlobalProtect portal.
  4. Send the crafted POST to the portal endpoint with a malformed SESSID cookie.
  5. Observe arbitrary command execution.

Public PoCs landed within 48 hours of disclosure (watchTowr, Assetnote, others). Use them after reading the official advisory.

Affected versions

  • PAN-OS 11.1 through 11.1.2-h2.
  • PAN-OS 11.0 through 11.0.4-h0.
  • PAN-OS 10.2 through 10.2.9-h0.

Only when GlobalProtect + device telemetry were both enabled. That’s a common production combination but not universal.

Detection and IR

  • Check PAN-OS for a recent change to telemetry-related scripts.
  • Search GlobalProtect logs for malformed SESSID strings (presence of shell metachars).
  • Compare on-disk Python scripts under /opt/pancfg/ against a clean baseline hash.
  • Look for outbound connections from the firewall management plane to unexpected hosts (UTA0218 used unusual C2 endpoints).
  • Validate no new admin users / API keys added during the exposure window.

If compromise confirmed: assume root persistence; factory reset is the only safe response.

Lessons

  • Cookies and headers are user input. They aren’t authenticated — even after login, the client controls them.
  • Filename derived from user input → shell is a classic and never goes away. Audit firewalls, routers, IoT for this pattern.
  • In-the-wild zero-day discovery is increasingly common; threat-intel vendors find the exploitation before vendors patch. Subscribe to Volexity, Mandiant, GTIG signals.
  • CVE-2022-30190 (Follina) — different class but same “input through unexpected path to shell” pattern.
  • CVE-2024-1709 (ConnectWise ScreenConnect — covered in cve-2024-1709-screenconnect-auth-bypass).
  • CVE-2023-3519 (Citrix NetScaler) — pre-auth on a different edge appliance.

The class is “pre-auth path through perimeter edge to OS command”. Always read this class first on a new appliance.

References