PAN-OS GlobalProtect Zero-Day RCE (CVE-2024-3400)

What to do

1. Confirm whether GlobalProtect is configured (Network > GlobalProtect > Gateways / Portals) and check the PAN-OS version.
2. Upgrade to a fixed hotfix for your branch, or a later supported release.
3. Until patched, apply Threat Prevention Threat IDs 95187, 95189 and 95191 with vulnerability protection on the GlobalProtect interface; disabling telemetry is not a mitigation.
4. Collect a Tech Support File before upgrading, then run the vendor's log check for exploitation attempts.
5. If the firewall was unprotected as of April 25, 2024 or shows signs of compromise, request an Enhanced Factory Reset through TAC and rotate credentials stored on or used by the firewall.

How to check if you are affected or compromised

• From the PAN-OS CLI run: grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log* and look for file paths or shell commands where a GUID should be.
• Look for the Unit 42 exploitation levels: zero-byte test files (Level 1), the running config copied to a web-accessible path (Level 2), or interactive commands/backdoors such as UPSTYLE or cron-based pollers (Level 3).
• Hunt downstream for lateral movement using firewall service accounts (SMB/WinRM) and for theft of ntds.dit, DPAPI keys or browser credential stores, as Volexity observed.

What happened#

On April 12, 2024, Palo Alto Networks disclosed CVE-2024-3400, a command injection flaw in the GlobalProtect feature of PAN-OS. The vendor describes it as arbitrary file creation that leads to OS command injection. It lets an unauthenticated remote attacker run code as root on the firewall. The vendor scores it CVSS 4.0 10.0, and NVD scores it CVSS 3.1 10.0.

The flaw was already being exploited as a zero-day. Volexity first detected exploitation at a customer on April 10, 2024, and found evidence of attacker testing as early as March 26. Volexity attributed the activity to a cluster it tracks as UTA0218, which it assessed is highly likely state-backed. The attackers attempted to install a Python backdoor called UPSTYLE. They stole firewall configurations and then moved into internal networks. In one case they used a firewall service account that was a Domain Admin to take the Active Directory database (ntds.dit), DPAPI keys and browser credential stores. CISA added the CVE to the KEV catalog on April 12, 2024, with a one-week deadline, and marks it as known to be used in ransomware campaigns.

Hotfixes rolled out between April 14 and April 18. The vendor later warned of a growing number of attacks, public proof-of-concept exploits, and third-party research into persistence that survives resets and upgrades.

Who is affected#

Firewalls running PAN-OS 10.2, 11.0 or 11.1 with a GlobalProtect gateway or portal configured. That includes customer-managed VM-Series firewalls. PAN-OS 9.0, 9.1, 10.0 and 10.1 are not affected, and neither are Cloud NGFW, Panorama appliances or Prisma Access. The advisory says device telemetry does not need to be enabled for the attack to work, and that disabling telemetry "is no longer an effective mitigation."

Do you really need to act?#

If you match the configuration above and are not on a fixed hotfix, yes, immediately. GlobalProtect is a VPN service, so it is internet-facing by design. Exploitation needs no credentials and gives root on a device that sits at the network edge and often holds privileged service accounts.

Patching may not be enough by itself. Unit 42 ranked compromises from Level 0 (failed probe) through Level 3 (interactive access). It said most of the cases it handled were unsuccessful attempts, Level 2 cases (config copied to a web-accessible path) were limited, and Level 3 cases were very limited. The vendor recommends an Enhanced Factory Reset for any customer that had not patched or applied signatures by April 25, 2024, whether or not compromise was confirmed.

If you were patched early, or don't run GlobalProtect on an affected branch, you can relax.

What to do now#

1. Check the version and whether GlobalProtect is configured (Network > GlobalProtect > Gateways or Portals).
2. Upgrade to the fixed hotfix for your release, such as 10.2.9-h1, 11.0.4-h1 or 11.1.2-h3, or to any later supported version. On Azure, hotfix names include an extra zero, so 11.1.2-h3 appears as 11.1.203.
3. If you cannot patch, enable Threat IDs 95187, 95189 and 95191 (content 8836-8695 or later) and apply vulnerability protection to the GlobalProtect interface.
4. Collect a Tech Support File before rebooting into the fixed version, because logs from the earlier install may become inaccessible.
5. If you suspect compromise or were unprotected as of April 25, 2024, open a TAC case for an Enhanced Factory Reset. Rotate any credentials stored on the firewall or used by it, such as LDAP or service accounts.

How to tell if you were hit#

• Run grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log* from the CLI. A GUID inside session(...) is normal. A file path or shell command is suspicious.
• Look for the Unit 42 levels: zero-byte test files, the running config copied to a web-accessible location, or backdoors such as UPSTYLE or cron jobs that poll external servers every minute.
• Hunt inside the network for SMB or WinRM use of firewall service accounts and for access to ntds.dit, as Volexity observed.

Timeline#

• Mar 26, 2024 — Earliest attacker testing Volexity found.
• Apr 10, 2024 — Volexity detects zero-day exploitation.
• Apr 12, 2024 — Advisory, Volexity and Unit 42 reports published, and CISA adds the CVE to KEV.
• Apr 14, 2024 — First hotfixes released (10.2.9-h1, 11.0.4-h1, 11.1.2-h3).
• Apr 18, 2024 — Remaining hotfixes released.
• May 3, 2024 — Enhanced Factory Reset guidance added.

Vulnerability records

• CVE-2024-3400 · KEV 2024-04-12 · A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Palo Alto Networks — CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect security.paloaltonetworks.com
2. NVD — CVE-2024-3400 nvd.nist.gov
3. CISA — Known Exploited Vulnerabilities Catalog cisa.gov
4. Volexity — Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) volexity.com
5. Unit 42 — Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 unit42.paloaltonetworks.com