CVE-2019-1579
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Description
CVE-2019-1579 is a high-severity format string vulnerability in Palo Alto Networks PAN-OS that enables remote code execution. The vulnerability affects PAN-OS devices with GlobalProtect Portal or GlobalProtect Gateway Interface enabled, allowing an unauthenticated remote attacker to execute arbitrary code by exploiting an externally-controlled format string in the SSL VPN component. This format string vulnerability in PAN-OS is particularly dangerous as it targets the widely-deployed GlobalProtect VPN solution. CISA has added CVE-2019-1579 to its Known Exploited Vulnerabilities catalog, and it is known to be leveraged in ransomware campaigns. With an EPSS score of 93.03% (99.78th percentile), exploitation activity is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | < 7.1.19; >= 8.0.0, < 8.0.12; >= 8.1.0, < 8.1.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/109310(Broken Link, Third Party Advisory, VDB Entry)
- https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/(Exploit, Third Party Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010(Broken Link, Third Party Advisory)
- https://security.paloaltonetworks.com/CVE-2019-1579(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579(US Government Resource)
Weakness Type
CWE-134: Use of Externally-Controlled Format String
In the context of CVE-2019-1579, the Palo Alto Networks PAN-OS GlobalProtect component uses user-supplied input directly as a format string argument in a formatting function. Attackers can inject format specifiers such as %s and %n to read from and write to arbitrary memory locations, ultimately achieving remote code execution on the affected PAN-OS device. Format string vulnerabilities provide exploitation primitives comparable to buffer overflows, enabling attackers to overwrite function pointers or return addresses.
Learn more: CWE-134 — Use of Externally-Controlled Format String
Impact Analysis
CVE-2019-1579 carries a CVSS 3.1 score of 8.1 (HIGH), representing a serious security threat to organizations using Palo Alto Networks GlobalProtect VPN. The vulnerability is remotely exploitable over the network without any authentication or user interaction, though the attack complexity is rated high, meaning some specific conditions must be met for successful exploitation. Confidentiality (High): successful exploitation grants the attacker access to all data accessible to the PAN-OS device, including VPN traffic and configuration secrets. Integrity (High): attackers can execute arbitrary code, enabling modification of firewall rules, VPN configurations, and system files. Availability (High): code execution can be used to disrupt VPN services and firewall operations. The EPSS score of 93.03% (99.78th percentile) indicates near-certain exploitation, and the vulnerability's confirmed use in ransomware campaigns makes it an urgent priority for organizations running affected PAN-OS versions.
Exploit Maturity
CVE-2019-1579 has a highly mature exploit landscape. Public exploit code is available via DEVCORE's detailed technical writeup, which demonstrates pre-authentication remote code execution on GlobalProtect using Uber as a case study. CISA has confirmed active exploitation in the wild through its KEV catalog listing with a remediation deadline of 2022-07-10, and the vulnerability is known to be leveraged in ransomware campaigns. The EPSS score of 93.03% (99.78th percentile) indicates near-certain exploitation activity. This vulnerability is particularly attractive to attackers because GlobalProtect VPN interfaces are typically exposed to the internet and successful exploitation provides access to the network perimeter device.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade PAN-OS to version 7.1.19+, 8.0.12+, or 8.1.3+ to address this format string vulnerability in GlobalProtect.
- Verify all PAN-OS devices in the organization, specifically those running PAN-OS versions prior to 7.1.19, 8.0.0 through 8.0.11-h1, and 8.1.0 through 8.1.2 with GlobalProtect Portal or Gateway Interface enabled, and ensure all are updated to patched versions.
- If immediate patching is not possible, restrict access to the GlobalProtect Portal and Gateway Interface to trusted IP ranges using access control lists or external firewall rules to reduce the attack surface while patches are being deployed.
- Review GlobalProtect VPN logs for indicators of exploitation, including abnormal authentication attempts, unexpected process activity on the PAN-OS device, and signs of command execution that may indicate prior compromise through the format string vulnerability.
- Harden format string defenses in the broader network by deploying intrusion prevention signatures that detect format string exploitation patterns targeting PAN-OS GlobalProtect, and implement network segmentation to limit the impact if the VPN gateway is compromised.
Technical Details
CVE-2019-1579 is caused by CWE-134 (Use of Externally-Controlled Format String) in the Palo Alto Networks PAN-OS GlobalProtect component. User-supplied input is passed directly as a format string argument to a formatting function without proper sanitization, allowing attackers to inject format specifiers to read stack memory (%x), crash the process, or write to arbitrary memory locations (%n) to achieve code execution. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the vulnerability is network-accessible and requires no authentication or user interaction, but the high attack complexity reflects that specific conditions (GlobalProtect Portal or Gateway Interface must be enabled) and exploit reliability factors affect successful exploitation. The vulnerability affects PAN-OS versions prior to 7.1.19, 8.0.0 through 8.0.11-h1, and 8.1.0 through 8.1.2, spanning multiple major release branches of the operating system.
Frequently Asked Questions
Is CVE-2019-1579 being actively exploited?
Yes. CVE-2019-1579 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It is also known to be leveraged in ransomware campaigns. The EPSS score of 93.03% (99.78th percentile) indicates near-certain exploitation activity, and public exploit code is available.
What products are affected by CVE-2019-1579?
CVE-2019-1579 affects Palo Alto Networks PAN-OS versions prior to 7.1.19, versions 8.0.0 through 8.0.11-h1, and versions 8.1.0 through 8.1.2 when GlobalProtect Portal or GlobalProtect Gateway Interface is enabled. Devices without GlobalProtect enabled are not affected.
How do I fix CVE-2019-1579?
Upgrade PAN-OS to version 7.1.19 or later, 8.0.12 or later, or 8.1.3 or later. If immediate patching is not possible, restrict access to the GlobalProtect interface to trusted IP ranges. After patching, review logs for signs of prior exploitation.
How severe is CVE-2019-1579?
CVE-2019-1579 has a CVSS 3.1 score of 8.1 (HIGH) and enables unauthenticated remote code execution on PAN-OS devices running GlobalProtect. With an EPSS score in the 99.78th percentile and confirmed ransomware usage, this vulnerability demands immediate remediation for any affected device exposed to the internet.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.