CVE-2021-3062 PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users

2021-11-1017:10:27

CWE-284

palo_alto

www.cve.org

access control

vulnerability

pan-os

globalprotect

aws

ec2

vm-series firewalls

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

36.9%

JSON

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

CNA Affected

[
  {
    "platforms": [
      "VM-Series"
    ],
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "10.1.*"
      },
      {
        "changes": [
          {
            "at": "9.1.11",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.11",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "8.1.20",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.20",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.14",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.14",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.8",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.8",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "2.1 all"
      },
      {
        "status": "unaffected",
        "version": "2.2 all"
      }
    ]
  }
]