letsdefend-cve2024-3400-case-study

letsdefend-cve2024-3400-case-study CVE-2024-3400 の悪用試行を標的とした Palo Alto PAN-OS GlobalProtect ポータルに対する検知、分析、および対応戦略。IOC、悪用パターン、緩和策のガイダンスを含みます。 CVE-2024-3400 インシデント調査 🔍 概要 このリポジトリには、Palo Alto Networks PAN-OS ソフトウェア、特に GlobalProtect ポータルを標的とした、重大な未認証コマンドインジェクション脆弱性である CVE-2024-3400...

CVE-2024-3400-pot

CVE-2024-3400-pot CVE-2024-3400 Palo Alto PAN-OS 명령 삽입 취약점을 위한 간단한 허니팟입니다. 특징 /global-protect/login.esp GlobalProtect 포털의 로그인 페이지 방문 시 시뮬레이션 HTTP 요청 POST /ssl-vpn/hipreport.esp 및 Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/; 시뮬레이션 쿠키에서 파일명 추출 있는 경우 POST 요청의 내용을 파일로...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto OS 명령 주입 다음 HTTP 요청을 전송하세요: POST /ssl-vpn/hipreport.esp HTTP/1.1 Host: 127.0.0.1 Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/hellome1337.txt; Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 0 서...

CVE-2024-3400-Palo-Alto-OS-Command-Injection

단계 : 1. 다음 GET 요청을 실행하거나 브라우저에서 URL을 열어 장치에 파일0xr2r.txt이 있는지 확인합니다. https://domain.com/global-protect/portal/images/0xr2r.txt URL을 브라우저에서 열었을 때 404 응답이 오면 파일이 없는 것입니다. POST /ssl-vpn/hipreport.esp HTTP/1.1 Host: domain.com Cookie:...

cve-2024-3400-panos_rce_reproduction

CVE-2024-3400：Palo Alto PAN-OS GlobalProtect 命令注入远程代码执行 CVSS 10.0 严重 | CWE-78：OS 命令注入 | 已在野外大规模利用 概述 CVE-2024-3400 是 Palo Alto Networks PAN-OS GlobalProtect 门户和网关接口中的一个预认证命令注入漏洞。该漏洞允许未经认证的攻击者在受影响的防火墙上以 root 权限执行任意命令。 发现者： Volexity（2024 年 4 月） 归属威胁行为者： UNC4554 / Midnight Blizzard（俄罗斯国家资助） CVE ID：...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

PAN-OS CVE-2024-3400 명령 삽입 시도 조사 개요 이 프로젝트는 PAN-OS GlobalProtect 서비스를 대상으로 한 CVE-2024-3400 명령 삽입 시도 에 대한 조사를 문서화합니다. 목표는 다음을 확인하는 것입니다: 실제 공격인지 여부 명령 실행이 발생했는지 여부 침해 증거가 있는지 여부 알림 개요 가능한 악용 시도를 나타내는 중요 알림이 트리거되었습니다. 대상: 172.16.17.139 PA-Firewall-01 출처: 144.172.79.92 엔드포인트: /global-protect/login.e...

EUVD-2026-49955

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

CVE-2026-49843

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's JSON-RPC handler bound the connection to the client-supplied sessid on the fir...

CVE-2026-49843 FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's JSON-RPC handler bound the connection to the client-supplied sessid on the fir...

CVE-2026-49843 FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's JSON-RPC handler bound the connection to the client-supplied sessid on the fir...

CVE-2026-49843 FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's JSON-RPC handler bound the connection to the client-supplied sessid on the fir...

EUVD-2006-5918

Malware in sbrugna...

EUVD-2019-17275

Malware in sbrugna...

CVE-2015-3423: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 ctrl, 2 h%2427, 3 h%2439, 4 param0, 5 param1, 6 param2, 7 param3, 8 param4, 9 filterINSERTCOUNT, 10 filterMINORFALLOUT, 11...

Session fixation

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

CVE-2019-7747

CVE-2019-7747 affects DbNinja 3.2.7 and enables session fixation through the data.php sessid parameter. The issue’s root cause is the use of a data.php sessid token that can allow an attacker to establish or hijack a user session. Public references indicate the vulnerability exists, with NVD noti...

CVE-2019-7747: Session Fixation

DbNinja 3.2.7 allows session fixation via the data.php sessid parameter...

IF-CMS 2.07 - Local File Inclusion (Metasploit) (2)

$Id: if-cms.rb 2011-03-15 20:28:10 tecr0c $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ -- coding:...