cve-2025-0133

CVE-2025-0133 Reflected XSS Detection Tool Author : Derek Odiorne Date : 2025-05-23 Severity : Medium Tested Against : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 Summary This script performs safe, authorized testing for the vulnerability CVE-2025-0133 , a reflected Cross-Site Scripting XSS...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...

CVE-2024-3400

CVE-2024-3400 Exploit for GlobalProtect CVE-2024-3400 This exploit targets the original vulnerability, so the firewall must be running a vulnerable PAN-OS version and must have telemetry enabled. Ref: https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/ Sample...

CVE-2024-3400-pot

CVE-2024-3400-pot Simple honeypot for CVE-2024-3400 Palo Alto PAN-OS Command Injection Vulnerability. Features Simulate when visiting the /global-protect/login.esp login page of the GlobalProtect Portal Simulate HTTP request POST /ssl-vpn/hipreport.esp & Cookie:...

CVE-2026-0257

Forge a GlobalProtect auth override cookie using the public key from TLS CVE-2026-0257 A proof-of-concept script to test a target PAN-OS GlobalProtect portal or gateway for CVE-2026-0257. The script will attempt to forge a valid authentication override cookie by iterating over the certificate cha...

CVE-2025-0133

CVE-2025-0133 Palo Alto PAN-OS reflected XSS in the GlobalProtect gateway and portal getconfig.esp handler. The user query parameter is reflected unencoded into the Captive Portal page; an attacker who lures an authenticated GlobalProtect user to a crafted link can execute JavaScript in the trust...

CVE-2024-3400-Palo-Alto-OS-Command-Injection

Steps : 1. Check whether file 0xr2r.txt is present on device by running below get request or We can verify same by openinig https://domain.com/global-protect/portal/images/0xr2r.txt Url in browser if you get 404 response that means file is not present. POST /ssl-vpn/hipreport.esp HTTP/1.1 Host:...

CVE-2025-0133

CVE-2025-0133 CVE-2025-0133 Exploit CVE-2025-0133 is a reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software. An authenticated user with access to the Captive Portal can be tricked into clicking a specially crafte...

CVE-2025-0133

CVE-2025-0133 Vulnerability Scanner A Bash-based automated scanner tool for detecting the CVE-2025-0133 Reflected XSS vulnerability in Palo Alto GlobalProtect Gateway & Portal using nuclei and shodanx. Author : Date : 2025-06-23 Severity : Medium CVE ID : CVE-2025-0133 Vulnerability Type :...

CVE-2024-3400-RCE-Scan

Cyberspace Mapping Dork Fofa app="paloalto-GlobalProtect" https://en.fofa.info/result?qbase64=YXBwPSJwYWxvYWx0by1HbG9iYWxQcm90ZWN0Ig%3D%3D Zoomeye app:"Palo Alto Networks firewall httpd"...

NachoVPN

NachoVPN 🌮🔒 NachoVPN is a Proof of Concept that demonstrates exploitation of SSL-VPN clients, using a rogue VPN server. It uses a plugin-based architecture so that support for additional SSL-VPN products can be contributed by the community. It currently supports various popular corporate VPN...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect The Pan-OS Checker is to determine the Palo Alto PAN-OS software version of a remote GlobalProtect portal or management interface. Before run the script, need to make sure version-table.txt in the same...

CVE-2024-3400

CVE-2024-3400 Vulnerability Description The CVE-2024-3400 vulnerability is a security vulnerability that affects PAN-OS firewalls in versions 10.2, 11.0, and 11.1. This vulnerability is exploited when GlobalProtect gateway and device telemetry configurations are enabled. An attacker can leverage...

CVE-2024-3400

PAN-OS Firewall Exploit Script This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection...

cve-2024-3400-poc

cve-2024-3400-poc Simple POC for CVE-2024-3400 based on the article https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/...

-CVE-2025-0133-GlobalProtect-XSS

mitsecvpnxssexploit 🔓 Exploit for GlobalProtect SSL VPN endpoint /ssl-vpn/getconfig.esp that appends a crafted XSS payload to the URL. Usage python3 exploit.py -u https://target.com Parameters -u, --url: Base target URL do not include query params Payload Preview prompt"mitsec" Author GitHub:...

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained acces...

globalprotect-ca-cert-ipc

c2us.exe - Launches a command as the running user in the desktop session of the logged on user. In thise case, launches cmd.exe as SYSTEM in the desktop session of the unprivileged user. c2us.c - Source code for c2us.exe. epinject.exe - Entry point injector, used to spawn a new process and inject...

CVE-2021-3060

CVE-2021-3060 POC/ Exploit Description: An OS command injection vulnerability in the Simple Certificate Enrollment Protocol SCEP feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root us...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection Vendor Description A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute...