Security Digest · Jul 10, 2024 · Vulnerability · Network edge
Palo Alto Expedition: Exploited Bugs in an EOL Firewall Tool
Three exploited Expedition bugs expose stored firewall passwords and API keys. Fixed in 1.2.96, but the tool is end of life. Shut it down and rotate secrets.
Our verdict
Check exposure
Expedition has been end of life since December 31, 2024 and should not be running; if you find one, shut it down and rotate every firewall credential and API key it ever held.
Who must act: Anyone who used Expedition to migrate or tune firewall configs and may still have the VM running, especially if it was reachable from the internet or a broad internal network before 1.2.96.
Who can relax: Organizations that never used Expedition, or that shut it down and rotated the credentials it processed. PAN-OS firewalls, Panorama, Prisma Access and Cloud NGFW are not affected.
- Affected
- Expedition 1.2 before 1.2.92 (CVE-2024-5910)
Expedition before 1.2.96 (CVE-2024-9463, CVE-2024-9465)
All Expedition versions: end of life since December 31, 2024, no further fixes - Fixed in
- Expedition 1.2.92 (CVE-2024-5910)
Expedition 1.2.96 (CVE-2024-9463, CVE-2024-9465)
Expedition 1.2.101 is the last release with security fixes - CVSS
- 9.8 (v3.1, NVD)
- EPSS
- 99.6% (percentile 99.9)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- Critical
What to do
- Search VM inventories, hypervisors and scan results for any Expedition server that still exists.
- Shut down and archive any Expedition VM; Palo Alto Networks says it is meant for temporary migration use, not production.
- Rotate every firewall and Panorama admin password and API key that was ever imported into Expedition.
- Rotate Expedition's own usernames and passwords, and any shared credentials they reuse.
- If one must run briefly, use 1.2.101 on an isolated network reachable only from an admin host, then shut it down.
How to check if you are affected or compromised
- Grep /var/apache/log/access.log on the Expedition host for /OS/startup/restore/restoreAdmin.php, /bin/Auth.php, /bin/CronJobs.php and /bin/configurations/parsers/Checkpoint/CHECKPOINT.php.
- Run mysql -uroot -p -D pandb -e "SELECT * FROM cronjobs;" on Expedition; any rows suggest compromise.
- On firewalls whose credentials Expedition held, review config and system logs for admin or API logins from unfamiliar addresses since the credentials were loaded.
What happened#
Expedition is Palo Alto Networks' free tool for migrating and tuning firewall configurations. To do that job it imports device configs, admin usernames and passwords, and API keys for the firewalls it manages. Three of its bugs are in CISA's KEV catalog:
- CVE-2024-5910, disclosed July 10, 2024 and fixed in 1.2.92: missing authentication that lets anyone with network access take over the Expedition admin account. NVD scores it 9.8.
- CVE-2024-9463 and CVE-2024-9465, disclosed October 9, 2024 and fixed in 1.2.96: an unauthenticated OS command injection that runs commands as root, and an unauthenticated SQL injection that dumps the database, including password hashes, device configs and API keys. The vendor scores them 9.9 and 9.2 in CVSS 4.0.
The same day, Horizon3.ai showed that a single unauthenticated request to /OS/startup/restore/restoreAdmin.php resets the admin password, and detailed the SQL injection in CHECKPOINT.php. It counted about 23 internet-exposed Expedition servers. CISA added CVE-2024-5910 to KEV on November 7, and CVE-2024-9463 and CVE-2024-9465 on November 14. Palo Alto Networks says it learned of the exploitation from CISA. No attacker has been named, SecurityWeek noted, and none had been as of Oct 23, 2026.
Who is affected#
Any Expedition 1 server older than 1.2.96 is vulnerable to all three, and anything below 1.2.92 to the admin takeover. More to the point, Expedition as a whole is finished. The end-of-life announcement covers both the Expedition 1 and Expedition 2 branches, and PAN-SA-2025-0001 states that Expedition "reached its End of Life (EoL) date on December 31, 2024." That January 2025 advisory fixed five more bugs in 1.2.100 and 1.2.101, and the vendor said it does "not plan to make any additional updates or security fixes." The firewalls themselves are not affected.
Do you really need to act?#
Only if Expedition is still around, but then yes. These machines often outlive the migration they were built for. A forgotten VM holds working admin credentials and API keys for your firewalls, and any compromise of it hands an attacker the keys to your perimeter. The vendor itself says the tool is "designed to only be used temporarily for migration purposes, not to be run in production." Patching an EOL tool is the wrong fix. Shut it down.
What to do now#
- Find every Expedition server: check hypervisor inventories and scan results, and on suspect Ubuntu VMs run
ls /var/www/html/OS/startup/restore/. - Collect the logs listed below, then power off and archive the VM.
- Rotate every firewall and Panorama admin password and API key that was ever imported into Expedition, as the vendor instructs, plus Expedition's own accounts and anything sharing their passwords.
- If you truly need it for one more migration, run 1.2.101 on an isolated segment reachable only from one admin host, and shut it down afterward.
How to tell if you were hit#
On the Expedition host, Horizon3 points to /var/apache/log/access.log. Search it for restoreAdmin.php, /bin/Auth.php, /bin/CronJobs.php and /bin/configurations/parsers/Checkpoint/CHECKPOINT.php. The vendor's check for the SQL injection is mysql -uroot -p -D pandb -e "SELECT * FROM cronjobs;"; any rows suggest compromise, though an empty result does not prove a clean box. Then check the firewalls whose credentials Expedition held for admin logins, API activity and commits from unexpected addresses in the PAN-OS system and configuration logs.
Timeline#
- — CVE-2024-5910 disclosed; fixed in 1.2.92.
- — PAN-SA-2024-0010 fixes CVE-2024-9463 and CVE-2024-9465 in 1.2.96; Horizon3.ai publishes its research.
- — CISA adds CVE-2024-5910 to KEV.
- — CISA adds CVE-2024-9463 and CVE-2024-9465.
- — Expedition reaches end of life.
- — PAN-SA-2025-0001 ships 1.2.101, the final fixes.
Vulnerability records
- CVE-2024-5910 · KEV 2024-11-07 · Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network…
- CVE-2024-9463 · KEV 2024-11-14 · An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition…
- CVE-2024-9465 · KEV 2024-11-14 · An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- Palo Alto Networks — PAN-SA-2024-0010: Multiple Vulnerabilities in Expedition Lead to Exposure of Firewall Credentials security.paloaltonetworks.com
- Palo Alto Networks — CVE-2024-5910 Expedition: Missing Authentication Leads to Admin Account Takeover security.paloaltonetworks.com
- Palo Alto Networks — PAN-SA-2025-0001: Multiple Vulnerabilities in Expedition Migration Tool Lead to Exposure of Firewall Credentials security.paloaltonetworks.com
- Palo Alto Networks — End of Life Announcement for Palo Alto Networks Expedition pan.dev
- CVE record — CVE-2024-5910 cve.org
- CVE record — CVE-2024-9463 cve.org
- CVE record — CVE-2024-9465 cve.org
- NVD — CVE-2024-5910 nvd.nist.gov
- NVD — CVE-2024-9463 nvd.nist.gov
- NVD — CVE-2024-9465 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2024-5910 cisa.gov
- CISA — Known Exploited Vulnerabilities: CVE-2024-9463 cisa.gov
- CISA — Known Exploited Vulnerabilities: CVE-2024-9465 cisa.gov
- Horizon3.ai — Palo Alto Expedition: From N-Day to Full Compromise horizon3.ai