Palo Alto Networks PAN-OS 8.1.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.5 / 10.0.x < 10.0.1 Authentication Bypass Vulnerability

##
# (C) Tenable Network Security, Inc.
##

include('compat.inc');

if (description)
{
  script_id(142875);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/02/19");

  script_cve_id("CVE-2020-2050");
  script_xref(name:"IAVA", value:"2020-A-0522-S");

  script_name(english:"Palo Alto Networks PAN-OS 8.1.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.5 / 10.0.x < 10.0.1 Authentication Bypass Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote PAN-OS host is affected by an authentication bypass vulnerability");
  script_set_attribute(attribute:"description", value:
"The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.17 or 9.0.x prior to 9.0.11 or
9.1.x prior to 9.1.5 or 10.0.x prior to 10.0.1. It is, therefore, affected by a vulnerability.

  - An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks
    PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid
    certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN
    network resources when the gateway or portal is configured to rely entirely on certificate-based
    authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect
    Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate
    verification is used in conjunction with other authentication methods, the protections added by the
    certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier
    than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-
    OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. (CVE-2020-2050)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.paloaltonetworks.com/CVE-2020-2050");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/285.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PAN-OS 8.1.17 / 9.0.11 / 9.1.5 / 10.0.1 or later");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-2050");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(285);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/11/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/11/13");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:paloaltonetworks:pan-os");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Palo Alto Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("palo_alto_version.nbin");
  script_require_keys("Host/Palo_Alto/Firewall/Version", "Host/Palo_Alto/Firewall/Full_Version", "Host/Palo_Alto/Firewall/Source");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

vcf::palo_alto::initialize();

app_name = 'Palo Alto Networks PAN-OS';

app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/Palo_Alto/Firewall/Full_Version', kb_source:'Host/Palo_Alto/Firewall/Source');

constraints = [
  { 'min_version' : '8.1.0', 'fixed_version' : '8.1.17' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.0.11' },
  { 'min_version' : '9.1.0', 'fixed_version' : '9.1.5' },
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.1' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);