Big zero-day flaw found in Palo Alto security appliance

Security researchers have said that a zero-day flaw in a security appliance from Palo Alto Networks could affect around 10,000 servers running the product.

Researchers at cyber security firm Randori said that flaw, tracked as CVE-2021-3064, affected PAN firewalls using the GlobalProtect Portal VPN and allowed for unauthenticated remote code execution on vulnerable product installations.

They added that the problem affected multiple versions of PAN-OS 8.1 before 8.1.17. Researchers found numerous vulnerable instances exposed on internet-facing assets, more than 10,000 assets.

“Our team was able to gain a shell on the affected target, access sensitive configuration data, extract credentials, and more. Once an attacker has control over the firewall, they will have visibility into the internal network and can proceed to move laterally,” said researchers.

Researchers developed a reliable working exploit and leveraged the capability as part of their red team products. The flaw was discovered over a year ago.

The bug is a buffer overflow that occurs while parsing user-supplied input into a fixed-length location on the stack. The problematic code is not reachable externally without using an HTTP-smuggling technique, according to researchers.

They added that the exploitation of these together yields remote code execution under the privileges of the affected component on the firewall device. “The smuggling capability was not designated a CVE identifier as it is not considered a security boundary by the affected vendor,” added researchers.

An attacker must have network access to the device on the GlobalProtect service port (default port 443) to exploit this vulnerability. As the affected product is a VPN portal, this port is often accessible over the internet, said researchers.

Exploitation is difficult but possible on devices with ASLR enabled, which is the case in most hardware devices. On virtualized devices — VM-series firewalls — exploitation is significantly easier due to lack of ASLR and Randori expects public exploits will surface.

“Randori researchers have not exploited the buffer overflow to result in controlled code execution on certain hardware device versions with MIPS-based management plane CPUs due to their big-endian architecture, though the overflow is reachable on these devices and can be exploited to limit availability of services,” they added.

The company said to avoid enabling misuse of the flaw, it will withhold the technical details related to CVE-2021-3064 from public dissemination for 30 days after the publication of the blog post on the subject.