CVE-2024-3400
Palo Alto Networks PAN-OS Command Injection Vulnerability
Description
CVE-2024-3400 is a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software, carrying the maximum CVSS v3.1 base score of 10.0. The flaw allows an unauthenticated remote attacker to exploit arbitrary file creation to achieve command injection, ultimately executing arbitrary code with root privileges on the firewall. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with an aggressive remediation deadline of April 19, 2024, and it has a known ransomware association. The EPSS score of 94.30% at the 99.9th percentile places this among the most actively exploited vulnerabilities ever tracked, reflecting widespread zero-day exploitation campaigns. Affected PAN-OS versions include 10.2.0 through 10.2.9, 11.0.0 through 11.0.4, and 11.1.0 through 11.1.2, while Cloud NGFW, Panorama appliances, and Prisma Access are not impacted.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | 10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 10.2.5; 10.2.6; 10.2.7; 10.2.8; 10.2.9; 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.1.0; 11.1.1; 11.1.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://security.paloaltonetworks.com/CVE-2024-3400(Vendor Advisory)
- https://unit42.paloaltonetworks.com/cve-2024-3400/(Exploit, Vendor Advisory)
- https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/(Technical Description, Vendor Advisory)
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-3400 by NVD. Based on the vulnerability description, this flaw involves two chained weaknesses: an arbitrary file creation vulnerability that is leveraged to achieve command injection in the GlobalProtect gateway. The file creation primitive allows an unauthenticated attacker to write attacker-controlled content to arbitrary locations on the PAN-OS filesystem. By writing to specific system locations, the attacker can influence command execution paths, ultimately injecting operating system commands that execute with root privileges. This chaining of file write and command injection primitives is particularly dangerous because it transforms a seemingly limited file creation bug into full remote code execution without any authentication requirement.
Impact Analysis
The impact of CVE-2024-3400 is catastrophic, representing the worst-case scenario for network security infrastructure compromise. Confidentiality faces total loss because root-level access on a PAN-OS firewall exposes all firewall configuration data including security policies, NAT rules, VPN configurations, GlobalProtect user credentials, decrypted SSL/TLS inspection traffic, and the firewall's private keys and certificates. The firewall sits at the network perimeter and processes all traffic flowing through it, making it an ideal position for passive traffic interception and credential harvesting.
Integrity is completely compromised as root access allows the attacker to modify firewall rules to permit unauthorized traffic, disable security features, create backdoor access rules, tamper with logging to hide malicious activity, and deploy persistent implants that survive reboots and potentially even firmware updates. An attacker can silently reconfigure the firewall to allow command-and-control traffic while maintaining the appearance of normal operation to security monitoring tools.
Availability faces critical risk because the attacker can disable the firewall entirely, disrupt VPN connectivity for all GlobalProtect users, or deploy destructive payloads. The known ransomware association confirms that ransomware operators are actively using this vulnerability, and firewall compromise provides the perfect staging point for encrypting entire network segments. The EPSS score of 94.30% at the 99.9th percentile confirms near-universal exploitation of exposed systems, and the Scope change (S:C) in the CVSS vector indicates that compromise of the firewall extends impact beyond the vulnerable component to the entire network infrastructure it protects.
Exploit Maturity
CVE-2024-3400 has reached maximum exploit maturity with confirmed zero-day exploitation, public exploit code, and active ransomware campaigns. The EPSS score of 94.30% at the 99.9th percentile indicates near-certain exploitation of any exposed vulnerable instance. CISA's KEV listing with an expedited April 19, 2024 deadline and the known ransomware association underscore the extreme urgency.
Unit 42, Palo Alto Networks' threat intelligence team, published detailed exploitation analysis at Unit 42 CVE-2024-3400 Advisory, documenting active zero-day exploitation before the patch was available. Volexity independently confirmed exploitation in the wild in their detailed technical analysis at Volexity Blog: Zero-Day Exploitation of CVE-2024-3400, identifying sophisticated threat actors leveraging this vulnerability for initial access into target networks. The official Palo Alto Networks security advisory is available at Palo Alto Networks Security Advisory CVE-2024-3400. The unauthenticated remote exploitation path with root-level code execution makes this trivially automatable, and multiple public exploit implementations have been observed. The combination of zero-day exploitation, public exploits, ransomware use, and a perfect CVSS score makes this one of the most dangerous vulnerabilities disclosed in 2024.
Remediation
-
Apply the PAN-OS hotfix immediately for all affected versions. Consult the Palo Alto Networks Security Advisory for specific hotfix versions for PAN-OS 10.2.x, 11.0.x, and 11.1.x branches. Given the 94.30% EPSS score and known ransomware association, any delay in patching represents near-certain compromise of exposed firewalls.
-
Apply the Threat Prevention signature as an interim mitigation if immediate patching is not possible. Palo Alto Networks released Threat Prevention signature updates that detect and block exploitation attempts targeting this vulnerability. Ensure Threat Prevention content is updated to the latest version and apply a vulnerability protection security profile to the GlobalProtect interface.
-
Disable GlobalProtect gateway and portal on affected firewalls as an emergency compensating control if neither the hotfix nor threat prevention signature can be deployed immediately. While this disrupts VPN connectivity, it eliminates the attack surface entirely. Redirect VPN users to alternative access methods until the firewall is patched.
-
Conduct comprehensive forensic analysis of any PAN-OS firewall that was running an affected version while exposed to the internet. Review PAN-OS system logs for indicators of compromise, check for unauthorized configuration changes, examine the filesystem for implants or backdoor scripts, and inspect running processes for anomalies. Palo Alto Networks and Volexity have published detailed IOCs in their respective advisories.
-
Reset all credentials and secrets that were accessible through or stored on the firewall after confirming successful patching. This includes GlobalProtect user credentials, administrator accounts, LDAP/RADIUS shared secrets, IPsec pre-shared keys, SSL/TLS certificates and private keys, and any API keys used for firewall management integrations.
Technical Details
CVE-2024-3400 is a command injection vulnerability in Palo Alto Networks PAN-OS, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, achieving the maximum base score of 10.0. Every exploitability metric is at its worst value. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means the exploit is reliable and does not require special conditions. Privileges Required (PR:N) indicates no authentication whatsoever is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:C) is changed, meaning the compromised firewall impacts resources beyond its own security context, reflecting the firewall's role in protecting the entire network.
The vulnerability exists in the GlobalProtect feature of PAN-OS and involves a two-stage exploitation chain. The first stage exploits an arbitrary file creation vulnerability that allows an unauthenticated attacker to write files with attacker-controlled content to arbitrary paths on the PAN-OS filesystem. The second stage leverages this file creation capability to achieve OS command injection by writing malicious content to a location that influences command execution, resulting in the injected commands running with root privileges. The GlobalProtect gateway processes incoming HTTPS requests from VPN clients, and the vulnerability is triggered through specially crafted requests to this interface. Because GlobalProtect gateways are designed to be internet-facing to serve remote access VPN users, the attack surface is inherently exposed. Affected versions include PAN-OS 10.2.0 through 10.2.9, 11.0.0 through 11.0.4, and 11.1.0 through 11.1.2. Cloud NGFW, Panorama, and Prisma Access use different architectures and are not vulnerable.
Frequently Asked Questions
What is CVE-2024-3400?
CVE-2024-3400 is a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS with the maximum CVSS score of 10.0. It allows unauthenticated remote attackers to execute arbitrary code with root privileges on the firewall through a combination of arbitrary file creation and command injection.
Was CVE-2024-3400 exploited as a zero-day?
Yes, CVE-2024-3400 was actively exploited as a zero-day before patches were available. Both Palo Alto Networks' Unit 42 team and security firm Volexity independently confirmed exploitation in the wild, with sophisticated threat actors using the vulnerability for initial network access.
Is my firewall affected if I don't use GlobalProtect?
If GlobalProtect gateway or portal is not enabled on your PAN-OS firewall, you are not vulnerable to this specific exploit. However, Palo Alto Networks still recommends applying the hotfix as a precautionary measure. Cloud NGFW, Panorama appliances, and Prisma Access are confirmed not affected.
Is this vulnerability associated with ransomware?
Yes, CISA has confirmed a known ransomware association for CVE-2024-3400. Ransomware operators are actively exploiting this vulnerability to gain initial access to networks through compromised firewalls, making immediate patching critical for preventing ransomware incidents.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.