Cortex XSOAR: Cleartext Exposure of Client Certificate Key in Kafka v3 Integration

A problem with the Cortex XSOAR Kafka v3 integration can result in the cleartext exposure of the configured Kafka client certificate key. Work around: No work around available...

Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)

The Palo Alto Networks Product Security Assurance team is evaluating the recently disclosed denial-of-service DoS vulnerabilities in the HTTP/2 protocol including Rapid Reset CVE-2023-44487 and CVE-2023-35945. If HTTP/2 inspection is enabled in PAN-OS, an ongoing distributed denial-of-service DDo...

Impact of libwebp Vulnerability CVE-2023-4863

The Palo Alto Networks Product Security Assurance team has evaluated the recently disclosed critical libwebp vulnerability CVE-2023-4863 as it relates to our products. While PAN-OS 10.2 and later versions include this library, PAN-OS software does not offer any scenarios required for the successf...

Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. Work around: No work around available...

PAN-OS: Denial-of-Service (DoS) Vulnerability in BGP Software

BGP software such as FRRouting FRR included as part of the PAN-OS, Prisma SD-WAN ION, and Prisma Access routing features enable a remote attacker to incorrectly reset network sessions though an invalid BGP update. This issue is applicable only to devices and appliances with BGP routing features...

Informational Bulletin: Impact of TunnelCrack Vulnerabilities (CVE-2023-36671, CVE-2023-36672, CVE-2023-35838, and CVE-2023-36673)

The Palo Alto Networks Product Security Assurance team is aware of the research publication that details a combination of attacks named "TunnelCrack". These are also referred to as LocalNet and ServerIP attacks as detailed below. These attacks leak VPN client traffic outside of the protected VPN...

PAN-OS: Read System Files and Resources During Configuration Commit

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system. Work around: This issue requires the attacker to have authenticated access ...

Informational Bulletin: Impact of MOVEit Vulnerabilities (CVE-2023-34362, CVE-2023-35036, CVE-2023-35708)

The Palo Alto Networks Product Security Assurance team has evaluated the recently disclosed critical Structured Query Language injection SQLi vulnerabilities CVE-2023-34362, CVE-2023-35036, CVE-2023-35708 in the MOVEit Transfer product. Palo Alto Networks does not use MOVEit Transfer and is not...

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

A reflected cross-site scripting XSS vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link. Work around:...

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

A local privilege escalation PE vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges. Work around: No work around available...

PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface

A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition. Work around: This issue requires the attacker to have authenticated access to...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed. Work around:...

GlobalProtect App: Local File Deletion Vulnerability

A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition. Work around: No work around available...

PAN-OS: Exposure of Sensitive Information Vulnerability

A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys. Work around: This issue requires the attacker to have authenticated access to the PAN-OS management...

PAN-OS: Local File Deletion Vulnerability

A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software...

Informational Bulletin: Impact of Rorschach Ransomware

The Palo Alto Networks Product Security Assurance team is aware of an article that details a strain of ransomware dubbed “Rorschach.” When removed from its installation directory, the Cortex XDR Dump Service Tool cydump.exe, which is included with Cortex XDR agent on Windows, can be used to load...

Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server. Work around: There are no known workarounds for this issue...

Cortex XDR Agent: Product Disruption by Local Windows User

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent. Work around: There are no known workarounds for this issue...

Impact of Sudo Vulnerability CVE-2023-22809

The Palo Alto Networks Product Security Assurance team has evaluated the sudo software vulnerability CVE-2023-22809 and has determined that the following Palo Alto Networks products do not expose the sudo program and, therefore, do not offer any scenarios required for successful exploitation of...

Impact of OpenSSL Vulnerabilities Disclosed Feb 7, 2023

The Palo Alto Networks Product Security Assurance team has evaluated the OpenSSL vulnerabilities that were disclosed on February 7, 2023 CVE-2023-0286, CVE-2022-4304, CVE-2022-4203, CVE-2023-0215, CVE-2022-4450, CVE-2023-0216, CVE-2023-0217, and CVE-2023-0401 as it relates to our products. At thi...

Cortex XDR Agent: Cleartext Exposure of Agent Admin Password

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agen...

Impact of OpenSSL 3.0 Vulnerability CVE-2022-3996

The OpenSSL Project has published a vulnerability CVE-2022-3996 that affects OpenSSL versions 3.0.0 through 3.0.7 on December 13, 2022. Exploitation of this vulnerability can result in a denial of service to an impacted application on Windows systems. The Palo Alto Networks Product Security...

Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine

A local privilege escalation PE vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges. Work around: There are no known workarounds for this issue...

Impact of Apache Text Commons Vulnerability CVE-2022-42889

Palo Alto Networks has evaluated the Apache Commons Text library vulnerability CVE-2022-42889, known as Text4Shell, for all products and services. The Palo Alto Networks Product Security Assurance team has confirmed that all products and services are not impacted by this vulnerability. Work aroun...

Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602

The OpenSSL Project has published two high severity vulnerabilities CVE-2022-3786 and CVE-2022-3602 that affect OpenSSL versions 3.0.0 through 3.0.6 on November 1st, 2022. The Palo Alto Networks Product Security Assurance team has evaluated and confirmed that all products and services are not...

PAN-OS: Authentication Bypass in Web Interface

An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions. Work around: Customers wit...

Informational: PAN-OS: Impact of the NVIDIA Dataplane Development Kit (DPDK) Vulnerability CVE-2022-28199

The Palo Alto Networks Product Security Assurance team evaluated the NVIDIA Dataplane Development Kit DPDK vulnerability CVE-2022-28199 as it relates to our products. This vulnerability causes networking stacks that use the NVIDIA distribution of the DPDK to enter an unrecoverable state when...

Informational: Cortex XDR Agent: Allow List is Visible to Low Privileged Users

The Palo Alto Networks Product Security Assurance team is aware of a method that enables a low privileged user on a Windows device to determine which local file system resources are part of the Cortex XDR agent’s configured allow list. These files are not analyzed by the agent and knowledge of th...

Informational: Cortex XDR Agent: Product Disruption by Local Windows Administrator

The Palo Alto Networks Product Security Assurance team is aware of a method that can enable a local administrator to tamper with the Windows registry to disable the Cortex XDR agent on devices running a Windows operating system. As a result of this method, critical Windows system services would n...

Cortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support File

An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file. Work around: No work around available...

Informational: Cortex XDR Agent: Proof of Concept (PoC) Reduces Effectiveness of Anti-Ransomware Protection Module

The Palo Alto Networks Product Security Assurance team is aware of a specifically crafted proof of concept PoC that reduces the effectiveness of the Cortex XDR agent Anti-Ransomware endpoint protection module. The specific technique used in the PoC does not impact behavioral threat protection,...

PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service RDoS attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series hardware, VM-Series virtual and CN-Series container firewall...

Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability

A local privilege escalation PE vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory such as C:\ to execute a program with elevated privileges. This issue impacts all...

PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability

A local privilege escalation PE vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory such as C:\ to execute a program with elevated privileges. This issue impacts: All...

Cortex XSOAR: Incorrect Authorization Vulnerability When Generating Reports

An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including incidents to which the user does not hav...

Informational: Cortex XDR Agent: Product Disruption by Local Windows Administrator

The Palo Alto Networks Product Security Assurance team is aware of a technique that can enable a local administrator to tamper with the Windows registry to disable the Cortex XDR agent on devices running a Windows operating system. As a result, critical Windows system services would not be...

Cortex XDR Agent: Supervisor Password Hash Disclosure Vulnerability When Generating Support Files

An information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local user to learn the cryptographic hash of the supervisor password when generating support files on a deployed agent. An attacker must crack the supervisor password hash to make unauthorized...

PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy

An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle MITM to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to...

Informational: Impact of Spring Vulnerabilities CVE-2022-22963 and CVE-2022-22965

The Palo Alto Networks Product Security Assurance team has completed its evaluation of the Spring Cloud Function vulnerability CVE-2022-22963 and Spring Core vulnerability CVE-2022-22965 for all products and services. All Palo Alto Networks cloud services with possible impact have been mitigated...

Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778

The Palo Alto Networks Product Security Assurance team has evaluated the OpenSSL infinite loop vulnerability CVE-2022-0778 as it relates to our products. This vulnerability causes the OpenSSL library to enter an infinite loop when parsing an invalid certificate and can result in a Denial-of-Servi...

Informational: Impact of the Samba Vulnerability CVE-2021-44142 on PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the Samba CVE-2021-44142 vulnerability. Though PAN-OS software contains Samba packages, there isn’t a Samba server that runs in PAN-OS software that could enable an attacker to exploit this vulnerability, which means there are n...

PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes

Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal non-FIPS-CC operationa...

GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon

An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions...

PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering

PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed depending on your rules regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list EDL i...

Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators...

GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation

An improper link resolution before file access 'link following' vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This iss...

GlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On Enabled

An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect portal configuration. This product...

GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon With SAML Authentication

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app when the feature is configured to use SAML authentication that enables a local attacker to escalate to SYSTEM or root privileges when...

GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux

An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of GlobalProtect users that saved their password during previous GlobalProtect app sessions to other local users on the system. The exposed...