CVE-2024-9463
Palo Alto Networks Expedition OS Command Injection Vulnerability
Description
CVE-2024-9463 is a high-severity OS command injection vulnerability in Palo Alto Networks Expedition, a migration and configuration tool used to transition firewall settings to PAN-OS. An unauthenticated attacker can exploit this flaw to run arbitrary operating system commands as root on the Expedition system, resulting in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. With a CVSS v3.1 base score of 7.5, the vulnerability affects Expedition versions 1.2.0 through 1.2.96. CISA has added CVE-2024-9463 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2024, and its EPSS score of 94.20% at the 99.9th percentile confirms near-certain active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | expedition | >= 1.2.0, < 1.2.96 |
References
- https://security.paloaltonetworks.com/PAN-SA-2024-0010(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463(US Government Resource)
Weakness Type
OS Command Injection in Expedition
CVE-2024-9463 is an OS command injection vulnerability in Palo Alto Networks Expedition. OS command injection occurs when an application passes user-controllable input to operating system commands without proper sanitization, allowing an attacker to inject and execute arbitrary commands. In Expedition, certain request parameters are incorporated into system-level commands executed on the underlying server without adequate input validation. Because the Expedition service runs with root privileges, injected commands execute with the highest possible system-level access. This vulnerability is particularly dangerous because Expedition is designed to store and process firewall configurations and credentials, meaning root-level access immediately exposes the most sensitive network security data in the organization.
Impact Analysis
The impact of CVE-2024-9463 is focused primarily on confidentiality, with the CVSS vector reflecting a high confidentiality impact but no direct integrity or availability impact. Confidentiality is fully compromised because root-level command execution on the Expedition system provides unrestricted access to all data stored on the server. This includes usernames and cleartext passwords for PAN-OS firewall administrators, complete device configurations containing security policies and network architecture details, and device API keys that can be used to programmatically control firewalls. The exposure of cleartext passwords is particularly severe, as it eliminates the need for password cracking and provides immediate access to production firewall infrastructure.
While the CVSS vector rates integrity and availability as not impacted (I:N/A:N), this reflects the direct impact on the Expedition system itself. In practice, the stolen credentials and API keys can be used to compromise the integrity and availability of the PAN-OS firewalls that Expedition manages, enabling attackers to modify firewall rules, create persistent access, or disrupt network security controls. The EPSS score of 94.20% at the 99.9th percentile places this among the most actively exploited vulnerabilities. While the ransomware association is listed as unknown, the direct exposure of firewall credentials provides an efficient pathway for attackers to disable security controls and deploy ransomware across the network.
Exploit Maturity
CVE-2024-9463 has reached the highest level of exploit maturity with confirmed active exploitation. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2024, and the EPSS score of 94.20% at the 99.9th percentile places it among the top 0.1% of all vulnerabilities for exploitation probability.
Palo Alto Networks has published a comprehensive advisory at PAN-SA-2024-0010 covering this and related Expedition vulnerabilities, including mitigation guidance. CVE-2024-9463 is part of a cluster of critical Expedition vulnerabilities (alongside CVE-2024-9465, a SQL injection flaw) that were disclosed together, and attackers are likely exploiting multiple Expedition weaknesses in combination. While the ransomware classification remains unknown, the ability to extract cleartext passwords and API keys for PAN-OS firewalls without any authentication makes this a high-value target for any threat actor seeking to compromise network security infrastructure at scale.
Remediation
-
Upgrade Expedition to version 1.2.96 or later. Apply the security update referenced in Palo Alto Networks' advisory at PAN-SA-2024-0010. This patch addresses the OS command injection vulnerability along with other related security issues in Expedition.
-
Isolate Expedition from untrusted networks. Ensure the Expedition web interface is accessible only from a dedicated management network. Expedition should never be exposed to the internet, and access should be limited to authorized administrators performing firewall migration tasks. Implement strict network segmentation and access control lists.
-
Immediately rotate all credentials processed by Expedition. Since this vulnerability exposes cleartext passwords and API keys, all credentials that were stored in or processed by the affected Expedition instance must be considered compromised. Change all PAN-OS administrator passwords, regenerate all device API keys, and rotate any service account credentials that were used during migration workflows.
-
Audit managed firewalls for unauthorized access. Review authentication logs on all PAN-OS firewalls that were managed through Expedition. Look for unauthorized login attempts using the compromised credentials, unexpected API calls, new administrator accounts, and any configuration changes that were not authorized through standard change management procedures.
-
Evaluate decommissioning Expedition. If active migration work is complete, strongly consider decommissioning the Expedition tool entirely. The combination of multiple critical vulnerabilities and the sensitive nature of the data it stores makes it a persistent security risk. If Expedition is still needed, ensure it runs on an isolated system with minimal network exposure and regular security patching.
Technical Details
CVE-2024-9463 is an OS command injection vulnerability in Palo Alto Networks Expedition with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, resulting in a base score of 7.5. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N). Notably, only confidentiality is rated high (C:H), while integrity and availability are rated as not impacted (I:N/A:N).
The vulnerability exists in Expedition's web application where certain request parameters are passed to operating system commands without proper sanitization. An unauthenticated attacker can inject shell metacharacters and additional commands into these parameters, which are then executed by the underlying operating system with root privileges. Common injection techniques include command chaining using semicolons (;), pipes (|), command substitution using backticks or $(), and boolean operators (&& or ||).
The root-level execution context is particularly significant because it provides unrestricted file system access, allowing the attacker to read any file on the Expedition server. Expedition stores firewall credentials in cleartext or weakly protected formats, making them immediately accessible to an attacker with root access. The scope is unchanged (S:U), meaning the vulnerability directly affects only the Expedition system, but the exposed credentials serve as a bridge to compromise production PAN-OS firewalls. Affected versions include Expedition 1.2.0 through 1.2.95.
Frequently Asked Questions
What is CVE-2024-9463?
CVE-2024-9463 is an OS command injection vulnerability in Palo Alto Networks Expedition that allows an unauthenticated attacker to execute arbitrary commands as root. This results in the exposure of cleartext passwords, usernames, device configurations, and API keys for PAN-OS firewalls.
How does CVE-2024-9463 differ from CVE-2024-9465?
Both vulnerabilities affect Palo Alto Networks Expedition and were disclosed in the same advisory. CVE-2024-9463 is an OS command injection vulnerability that runs commands as root (CVSS 7.5, confidentiality only), while CVE-2024-9465 is a SQL injection vulnerability that accesses the database and file system (CVSS 9.1, confidentiality and integrity). Both are unauthenticated and provide access to sensitive firewall credentials.
Why are cleartext passwords exposed?
Expedition is designed to migrate firewall configurations between platforms, which requires it to store and process administrative credentials. The OS command injection provides root-level access to the file system where these credentials are stored, and in the affected versions, credentials are accessible in cleartext or easily reversible formats.
Is Expedition the same as PAN-OS?
No. Expedition is a separate migration and configuration tool, not part of the PAN-OS firewall operating system itself. However, Expedition stores credentials and configurations for PAN-OS firewalls, so compromising Expedition can lead to compromising the firewalls it manages.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.