CVE-2024-9465
Palo Alto Networks Expedition SQL Injection Vulnerability
Description
CVE-2024-9465 is a critical SQL injection vulnerability in Palo Alto Networks Expedition, a migration and configuration tool used to transition firewall configurations to PAN-OS. An unauthenticated attacker can exploit this flaw to access the Expedition database and extract sensitive contents including password hashes, usernames, device configurations, and device API keys. With a CVSS v3.1 base score of 9.1, the vulnerability also allows attackers to create and read arbitrary files on the Expedition system. It affects Expedition versions 1.2.0 through 1.2.96. CISA has added CVE-2024-9465 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2024, and its EPSS score of 94.29% at the 99.9th percentile indicates near-certain active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | expedition | >= 1.2.0, < 1.2.96 |
References
- https://security.paloaltonetworks.com/PAN-SA-2024-0010(Mitigation, Vendor Advisory)
- https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9465(US Government Resource)
Weakness Type
SQL Injection in Expedition
CVE-2024-9465 is a SQL injection vulnerability in Palo Alto Networks Expedition. SQL injection occurs when an application incorporates user-supplied input into SQL queries without proper sanitization or parameterization, allowing an attacker to manipulate the query structure. In Expedition, certain input parameters are passed directly into database queries without adequate validation, enabling an unauthenticated attacker to inject malicious SQL statements. These injected statements can extract data from the database, modify or delete records, and in many database configurations, interact with the underlying file system. The Expedition database is particularly sensitive because it stores firewall configuration data, credentials, and API keys used during the migration process.
Impact Analysis
The impact of CVE-2024-9465 is severe, with maximum ratings for both confidentiality and integrity. Confidentiality is fully compromised because the SQL injection provides direct access to the Expedition database, which contains some of the most sensitive data in a network security environment: password hashes for firewall administrators, usernames, complete device configurations including security policies, and device API keys. This data represents the keys to an organization's entire firewall infrastructure, as Expedition is specifically designed to hold and process these configurations during migration.
Integrity faces maximum impact because the SQL injection allows the attacker to not only read but also modify database contents and create arbitrary files on the Expedition system. An attacker could alter stored configurations to introduce security weaknesses, modify user credentials to establish persistent access, or create files that serve as backdoors on the system. The ability to write arbitrary files extends the impact beyond the database to the file system level.
Availability is not directly impacted (A:N) according to the CVSS vector, which means the vulnerability primarily enables data theft and system manipulation rather than service disruption. However, the practical consequences are severe because the stolen credentials and API keys can be used to compromise the actual PAN-OS firewalls that Expedition manages. The EPSS score of 94.29% at the 99.9th percentile confirms extremely high exploitation activity, and while the ransomware association is listed as unknown, the access to firewall credentials makes this a high-value target for all types of threat actors.
Exploit Maturity
CVE-2024-9465 has reached the highest level of exploit maturity, confirmed by its inclusion in CISA's Known Exploited Vulnerabilities catalog and an EPSS score of 94.29% at the 99.9th percentile. This places it among the most actively exploited vulnerabilities globally.
Detailed exploitation research has been published by Horizon3.ai, which documented the complete attack path from the SQL injection vulnerability to full system compromise. The research demonstrates how attackers can chain this SQL injection with other Expedition vulnerabilities to achieve complete control over the migration tool and subsequently compromise managed firewalls. Palo Alto Networks has published a comprehensive advisory at PAN-SA-2024-0010 covering this and related Expedition vulnerabilities. While the ransomware classification remains unknown, the ability to extract firewall credentials and API keys without authentication makes this vulnerability an extremely efficient initial access vector for attackers targeting network security infrastructure.
Remediation
-
Upgrade Expedition to version 1.2.96 or later. Apply the patch referenced in Palo Alto Networks' advisory at PAN-SA-2024-0010. This update addresses the SQL injection vulnerability along with other security issues in the Expedition tool.
-
Restrict network access to Expedition. Ensure that the Expedition web interface is only accessible from trusted management networks. Expedition should never be exposed to the internet or untrusted network segments. Apply strict firewall rules and network segmentation to limit access to authorized migration administrators only.
-
Rotate all credentials stored in Expedition. After patching, immediately change all passwords and regenerate all API keys that were stored in or processed by Expedition. This includes PAN-OS administrator passwords, service account credentials, and any API keys used for firewall management. Since the database may have been compromised, assume all stored credentials are exposed.
-
Audit firewall configurations for unauthorized changes. Review the configurations of all PAN-OS firewalls that were managed or migrated through the affected Expedition instance. Check for unauthorized administrator accounts, modified security policies, unexpected API key creations, and any configuration changes that may indicate the stolen credentials were used to access production firewalls.
-
Consider decommissioning Expedition after migration. If the Expedition tool is no longer actively needed for firewall migration, consider decommissioning it entirely. Expedition stores highly sensitive data and has been the subject of multiple critical vulnerabilities. Reducing the attack surface by removing unnecessary tools is a fundamental security practice.
Technical Details
CVE-2024-9465 is a SQL injection vulnerability in Palo Alto Networks Expedition with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, resulting in a critical base score of 9.1. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N). The availability impact is none (A:N), distinguishing this from full-compromise vulnerabilities.
The vulnerability exists in Expedition's web application, which accepts user input that is incorporated into SQL queries without proper parameterization or input validation. An unauthenticated attacker can inject SQL statements by manipulating request parameters, allowing them to interact directly with the underlying database engine. The Expedition database stores migration-related data including complete firewall configurations exported from source devices, administrator usernames and password hashes, device API keys for PAN-OS management, and various configuration metadata.
Beyond database access, the SQL injection can be leveraged for file system operations through database-specific features such as writing query results to files (SELECT INTO OUTFILE) or reading files into the database (LOAD_FILE). This extends the attack surface from pure data access to arbitrary file creation and reading on the Expedition server's file system. The scope is unchanged (S:U), meaning the vulnerability directly affects only the Expedition system, but the stolen credentials and configurations can be used as a pivot point to compromise the actual PAN-OS firewalls. Affected versions include Expedition 1.2.0 through 1.2.95.
Frequently Asked Questions
What is CVE-2024-9465?
CVE-2024-9465 is a critical SQL injection vulnerability in Palo Alto Networks Expedition that allows an unauthenticated attacker to extract sensitive data from the Expedition database, including firewall credentials, API keys, and device configurations. It has a CVSS v3.1 score of 9.1.
What data can be stolen through CVE-2024-9465?
The Expedition database contains password hashes, usernames, complete firewall device configurations, and device API keys. This data is particularly sensitive because it provides the keys needed to access and manage an organization's PAN-OS firewalls directly.
Is CVE-2024-9465 related to other Expedition vulnerabilities?
Yes. CVE-2024-9465 was disclosed alongside several other Expedition vulnerabilities in Palo Alto Networks' advisory PAN-SA-2024-0010, including CVE-2024-9463 (OS command injection). Attackers may chain multiple Expedition vulnerabilities together for maximum impact.
Should I remove Expedition after migration is complete?
Yes. If Expedition is no longer actively needed for firewall migration, decommissioning it is strongly recommended. The tool stores highly sensitive credentials and configurations, and has been the subject of multiple critical vulnerabilities. Removing unnecessary tools reduces your attack surface.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.