CVE-2022-0028
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
Description
CVE-2022-0028 is a reflected amplification denial-of-service (RDoS) vulnerability in Palo Alto Networks PAN-OS that allows a network-based attacker to conduct amplified TCP denial-of-service attacks. The vulnerability exists due to a URL filtering policy misconfiguration that enables the firewall to be abused as a traffic amplifier, reflecting and amplifying malicious traffic toward a target. Palo Alto Networks firewalls are widely deployed enterprise security appliances, and their abuse as amplification vectors can generate significant attack traffic. CISA has added CVE-2022-0028 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 4.68% (89th percentile), exploitation activity has been observed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | >= 8.1.0, < 8.1.23; >= 9.0.0, < 9.0.16; >= 9.1.0, < 9.1.14; >= 10.0.0, < 10.0.11; >= 10.1.0, < 10.1.6; >= 10.2.0, < 10.2.2; 8.1.23; 9.0.16; 9.1.14; 10.0.11; 10.1.6; 10.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
References
- https://security.paloaltonetworks.com/CVE-2022-0028(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0028(US Government Resource)
Weakness Type
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
CVE-2022-0028 exploits insufficient control over network message volume in Palo Alto Networks PAN-OS, where the URL filtering feature can be manipulated to generate amplified response traffic toward a victim's IP address. The misconfiguration allows the firewall to act as a reflection and amplification vector, where a small attacker request generates a disproportionately large response directed at the target.
Learn more: CWE-406 — Insufficient Control of Network Message Volume
Impact Analysis
CVE-2022-0028 poses a significant risk to both the organizations operating vulnerable Palo Alto Networks firewalls and the targets of the resulting DDoS attacks. The vulnerability is remotely exploitable over the network without authentication, requiring no user interaction and involving low attack complexity. By exploiting the URL filtering misconfiguration, an attacker can use the Palo Alto Networks firewall as a traffic amplifier to launch reflected denial-of-service attacks against arbitrary targets. This has dual impact: the targeted victim receives amplified DDoS traffic that can overwhelm their network infrastructure, and the organization owning the misconfigured firewall may experience performance degradation and bandwidth consumption from the amplified traffic. With an EPSS score of 4.68% (89th percentile), this vulnerability is actively being targeted for DDoS attack infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-0028 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 12, 2022. The EPSS score of 4.68% (89th percentile) reflects moderate exploitation activity. The vulnerability has been documented in detail by Palo Alto Networks in their security advisory, and the exploitation technique is well-understood — it involves sending crafted requests to the URL filtering feature that cause the firewall to generate amplified responses toward a spoofed source IP address. No specific ransomware campaigns are currently associated with this CVE, as the vulnerability is primarily used for denial-of-service rather than data compromise.
Remediation
- Apply PAN-OS updates immediately: Per the CISA KEV required action, apply updates per vendor instructions as documented in Palo Alto Networks security advisory CVE-2022-0028. Upgrade to the patched PAN-OS version.
- Review and correct URL filtering policy configuration: Audit the URL filtering policy on affected Palo Alto Networks firewalls to ensure the configuration does not allow the device to be used as a reflection/amplification vector. Follow Palo Alto Networks' configuration best practices.
- Implement anti-spoofing protections: Configure the firewall and upstream network infrastructure to block IP-spoofed traffic using BCP38/BCP84 anti-spoofing filters, preventing attackers from using spoofed source addresses to redirect amplified traffic.
- Rate-limit URL filtering responses: Configure rate limiting on the URL filtering feature to prevent the firewall from generating excessive response traffic that could be used for amplification.
- Monitor for unusual traffic patterns: Set up monitoring and alerting for abnormal traffic volumes originating from the firewall's URL filtering feature, which could indicate that the device is being actively exploited as a DDoS amplification vector.
Technical Details
CVE-2022-0028 is a reflected amplification denial-of-service vulnerability in the URL filtering feature of Palo Alto Networks PAN-OS. The vulnerability exists because the URL filtering policy, when misconfigured, allows the firewall to process and respond to external requests in a way that generates amplified response traffic. An attacker can send crafted URL filtering requests to the firewall with a spoofed source IP address (the victim's address). The firewall processes these requests and sends its responses — which are larger than the original requests — to the spoofed source address, effectively amplifying the traffic and directing it toward the victim. This is a classic reflected amplification attack pattern where the firewall serves as the unwitting amplifier. The amplification factor and the high-bandwidth capacity of enterprise firewalls make this a potent DDoS vector. The fix involves correcting the URL filtering policy configuration to prevent the firewall from responding to unsolicited external requests in an amplifiable manner.
Frequently Asked Questions
Is CVE-2022-0028 being actively exploited?
Yes. CISA has added CVE-2022-0028 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 4.68% (89th percentile) indicates ongoing exploitation activity. The vulnerability is being used to conduct reflected amplification DDoS attacks.
What products are affected by CVE-2022-0028?
CVE-2022-0028 affects Palo Alto Networks PAN-OS, the operating system for Palo Alto Networks firewalls. Specifically, devices with URL filtering policies that are misconfigured in a way that allows traffic amplification are vulnerable.
How do I fix CVE-2022-0028?
Apply the PAN-OS updates documented in the Palo Alto Networks security advisory for CVE-2022-0028. Review and correct URL filtering policy configurations to prevent the firewall from being used as an amplification vector. Implement anti-spoofing protections (BCP38/BCP84) on the network.
How severe is CVE-2022-0028?
CVE-2022-0028 is a high severity denial-of-service vulnerability that allows Palo Alto Networks firewalls to be abused as DDoS amplification vectors. With an EPSS score of 4.68% (89th percentile), it is actively being targeted. While it does not enable data compromise or code execution, the DDoS amplification capability can cause significant disruption to both the firewall operator and the DDoS target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.