PAN-OS web interface flaws enable authentication bypass and escalation
Palo Alto Networks PAN-OS contains authentication bypass (CVE-2024-0012) and privilege escalation (CVE-2024-9474) vulnerabilities in the web management interface, actively exploited in the wild.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-0012 and CVE-2024-9474 as exploited in the wild.
Japan's Information-technology Promotion Agency (IPA) has issued a security alert regarding critical vulnerabilities in Palo Alto Networks PAN-OS. The web management interface contains an authentication bypass vulnerability (CVE-2024-0012) and a privilege escalation vulnerability (CVE-2024-9474). Exploitation of these flaws allows unauthenticated remote attackers to gain administrative privileges, modify configurations, and escalate privileges on affected systems.
Palo Alto Networks has confirmed active exploitation of these vulnerabilities in the wild, raising concerns about widespread attacks. The vendor has released patched versions addressing both vulnerabilities. Cloud NGFW and Prisma Access products are not affected by these issues.
Organizations running vulnerable PAN-OS versions are urged to apply patches immediately following vendor guidance. The combination of authentication bypass and privilege escalation provides attackers with a complete compromise path for network security infrastructure, making this a high-priority remediation effort.
Mentioned in this report
Detection guidance
PAN-OS Management Web Interface Exposed to Untrusted Zone
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects inbound connections to the PAN-OS web management interface (HTTPS management ports) from an untrusted/external zone, indicating the interface is reachable from outside and vulnerable to remote authentication-bypass exploitation (CVE-2024-0012). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PAN-OS Management Interface Reachable From Untrusted Zone
id: 93c6f4e9-5460-53dc-9d28-9f67ce4c6373
status: experimental
description: 'Detects network sessions destined for the PAN-OS web management service
(typical HTTPS management ports) where the source zone is untrusted or external.
This exposure pattern is the prerequisite condition abused by CVE-2024-0012 (authentication
bypass) and CVE-2024-9474 (privilege escalation) to gain unauthenticated administrative
access to PAN-OS devices.
'
references:
- https://security.paloaltonetworks.com/CVE-2024-0012
- https://security.paloaltonetworks.com/CVE-2024-9474
author: Vorant
tags:
- attack.t1078
- attack.initial-access
logsource:
category: firewall
detection:
selection:
dst_port:
- 443
- 4443
- 8443
src_zone: untrust
filter:
src_zone: trust
condition: selection and not filter
falsepositives:
- Legitimate administrators or monitoring tools intentionally allowed to reach the
management interface from an external jump host or VPN-terminated zone that is still
labeled untrust
- Vulnerability scanners authorized by the organization performing external exposure
assessments
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20241119.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs