CVE-2024-3400-Compromise-Checker

CVE-2024-3400 Compromise Checker A very simple bash script to check for evidence of compromise related to CVE-2024-3400 on Palo Alto Firewalls. Designed to provide a quick initial triage of potentially impacted devices by checking for the existence of artefacts outlined in the Volexity writeup an...

CVE-2024-3400-

PAN-OS Firewall Command Injection Vulnerability This repository contains a Go script that exploits a Command Injection vulnerability in firewalls running Palo Alto Networks' PAN-OS operating system. The vulnerability, identified as CVE-2024-3400, allows an unauthenticated attacker to execute...

CVE-2025-0133

CVE-2025-0133 Vulnerability Scanner A Bash-based automated scanner tool for detecting the CVE-2025-0133 Reflected XSS vulnerability in Palo Alto GlobalProtect Gateway & Portal using nuclei and shodanx. Author : Date : 2025-06-23 Severity : Medium CVE ID : CVE-2025-0133 Vulnerability Type :...

CVE-2024-3400

CVE-2024-3400: OS Command Injection Vulnerability in GlobalProtect Gateway Severity: CRITICAL 10/10 ⚠️...

CVE-2024-3400

CVE-2024-3400 Vulnerability Description The CVE-2024-3400 vulnerability is a security vulnerability that affects PAN-OS firewalls in versions 10.2, 11.0, and 11.1. This vulnerability is exploited when GlobalProtect gateway and device telemetry configurations are enabled. An attacker can leverage...

CVE-2024-3400

CVE-2024-3400 Exploit for GlobalProtect CVE-2024-3400 This exploit targets the original vulnerability, so the firewall must be running a vulnerable PAN-OS version and must have telemetry enabled. Ref: https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/ Sample...

CVE-2021-3060

CVE-2021-3060 POC/ Exploit Description: An OS command injection vulnerability in the Simple Certificate Enrollment Protocol SCEP feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root us...

Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting

Palo Alto Networks PAN-OS before 8.1.4 GlobalProtect Portal Login page allows an unauthenticated attacker to inject arbitrary JavaScript or HTML, making it vulnerable to cross-site scripting. id: CVE-2018-10141 info: name: Palo Alto Networks PAN-OS GlobalProtect 8.1.4 - Cross-Site Scripting autho...

CVE-2025-0133

Description: It is a POC for CVE-2025-0133 that is applicable only to PAN-OS firewall configurations with an enabled GlobalProtect gateway or portal. It checks issue on multiple URLs that accepts from file, with custom thread. You can also set you timeout and get results in a file. Example usage:...

cve-2024-3400-poc

cve-2024-3400-poc Simple POC for CVE-2024-3400 based on the article https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/...

CVE-2024-3400-Check

Description 1. Perform a POST request to the /ssl-vpn/hipreport.esp endpoint. 2. Perform a GET request to /global-protect/portal/images/sxy.txt to check if the exploitation allows access to the file, which would typically be forbidden 403 Forbidden status. Prerequisites You need Python 3.6 or new...

CVE-2024-3400

PAN-OS Firewall Exploit Script This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection...

CVE-2025-0133

CVE-2025-0133 CVE-2025-0133 Exploit CVE-2025-0133 is a reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software. An authenticated user with access to the Captive Portal can be tricked into clicking a specially crafte...

cve-2025-0133

CVE-2025-0133 Reflected XSS Detection Tool Author : Derek Odiorne Date : 2025-05-23 Severity : Medium Tested Against : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 Summary This script performs safe, authorized testing for the vulnerability CVE-2025-0133 , a reflected Cross-Site Scripting XSS...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Investigating a PAN-OS CVE-2024-3400 Command Injection Attempt Overview This project documents the investigation of a CVE-2024-3400 command injection attempt targeting a PAN-OS GlobalProtect service. The goal was to determine: whether this is a real attack whether command execution occurred wheth...

CVE-2024-3400-RCE-Scan

Cyberspace Mapping Dork Fofa root@kitploit: app="paloalto-GlobalProtect" https://en.fofa.info/result?qbase64=YXBwPSJwYWxvYWx0by1HbG9iYWxQcm90ZWN0Ig%3D%3D Zoomeye root@kitploit: app:"Palo Alto Networks firewall httpd"...

CVE-2024-3400

CVE-2024-3400 Description A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code...

CVE-2026-0265-check

CVE-2026-0265 Vulnerability Assessment Tool Safely determine whether a Palo Alto Networks PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating any session or modifying any state. Description CVE-2026-0265 is a remote authentication bypass affecting PAN-OS and Panorama...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...

CVE-2026-0257

CVE-2026-0257 Vulnerabilidad de omisión de autenticación en PAN-OS GlobalProtect ⚡ Uso simple Utilice este proyecto solo en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aisladas Entornos de pruebas de penetración autorizados...