Palo Alto GlobalProtect Agent Local Privilege Escalation (CVE-2024-9473)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(209283);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/02/19");

  script_cve_id("CVE-2024-9473");
  script_xref(name:"IAVA", value:"2024-A-0649-S");

  script_name(english:"Palo Alto GlobalProtect Agent Local Privilege Escalation (CVE-2024-9473)");

  script_set_attribute(attribute:"synopsis", value:
"A VPN client installed on remote host is affected by a local privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices allows a locally 
authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of 
the repair functionality offered by the .msi file used to install GlobalProtect. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.paloaltonetworks.com/CVE-2024-9473");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Palo Alto GlobalProtect Agent 6.2.5, 6.3.1-c383 or later");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-9473");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:paloaltonetworks:globalprotect");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("palo_alto_globalprotect_agent_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Palo Alto GlobalProtect Agent");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

get_kb_item_or_exit("SMB/Registry/Enumerated");

vcf::palo_alto::initialize();

var app_info = vcf::get_app_info(app:'Palo Alto GlobalProtect Agent', win_local:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = 
  [
    {'min_version' : '5.1', 'fixed_version' :'5.2' , 'fixed_display' : 'See vendor advisory'},
    {'min_version' : '6.0', 'fixed_version' :'6.0.10-823'},
    {'min_version' : '6.1', 'max_version' : '6.1.4-719', 'fixed_version' :'6.1.4-720'},
    {'equal' : '6.1.5', 'fixed_display' : 'See vendor advisory'},
    {'min_version' : '6.2', 'fixed_version' : '6.2.5'},
    {'min_version' : '6.3', 'fixed_version' : '6.3.1-383'}
  ];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);