Horizon Alert
Summary of the vulnerability and why it matters
The PAN-OS software's management web interface is vulnerable. This flaw allows an unauthenticated attacker to bypass authentication and execute specific PHP scripts. The impact can include a negative effect on the integrity and confidentiality of the PAN-OS system.
- Vulnerable PAN-OS management interface
- Authentication bypass weakness
- Compromised system integrity and confidentiality
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker with network access can bypass the management web interface authentication of PAN-OS software. This allows the attacker to invoke specific PHP scripts. While this does not directly lead to code execution, it can impact the integrity and confidentiality of the PAN-OS system. Organizations can reduce this risk by restricting access to the management web interface to trusted internal IP addresses.
- Network access to management interface.
- Attacker bypasses authentication.
- Invokes PHP scripts, impacting data.
Live Threat
Current exploitation, exposure, and threat context
The identified vulnerability in Palo Alto Networks PAN-OS software allows unauthenticated attackers with network access to the management web interface to bypass security controls. This bypass enables the invocation of specific PHP scripts, which can impact the integrity and confidentiality of the PAN-OS system. While direct remote code execution is not enabled, the potential for system manipulation presents a significant risk. Organizations are advised to restrict access to the management web interface to trusted internal IP addresses as a recommended best practice to mitigate this risk.
- Likely attacker skill level: Low
- Required access or conditions: Network access to the management web interface
- Business risk or urgency: High
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An authentication bypass vulnerability in Palo Alto Networks' PAN-OS software allows an unauthenticated attacker with network access to the management web interface to invoke certain PHP scripts. This can negatively impact the integrity and confidentiality of PAN-OS. Affected PAN-OS versions include those prior to 10.1.14-h9, 10.2.13-h3, 11.1.6-h1, and 11.2.4-h4, among others.
- Identify all affected PAN-OS assets.
- Restrict management interface access.
- Apply vendor patches and monitor systems.
