CVE-2022-0028

What it actually does

This vulnerability is a reflected and amplified TCP denial-of-service condition in PAN-OS when a URL filtering profile with one or more blocked categories is incorrectly applied to a source zone that contains an externally facing interface. A remote, unauthenticated attacker can send traffic that causes the firewall to generate amplified TCP responses toward a spoofed victim address. The firewall itself is not compromised and the issue does not provide access to data or configuration, but the device can be abused as a reflector in a denial-of-service attack against a third party.

Why it matters to the business

An affected firewall can be made to appear as the origin of high-volume denial-of-service traffic, creating operational, reputational, and abuse-handling risk even though the firewall is not directly taken over. Organizations may receive complaints from upstream providers, customers, or third parties, and external firewall IP addresses could be rate-limited, blocked, or investigated as attack sources. Because this vulnerability is in CISA KEV with a remediation due date of 2022-09-12 and is reported as actively exploited in the wild, exposed and misconfigured deployments should be treated as high priority despite the relatively low EPSS score.

How an attack unfolds

An attacker first identifies a PAN-OS firewall interface reachable from the Internet or another untrusted network. The attack only works when URL filtering has been configured in an atypical way: a URL filtering profile that blocks one or more categories is applied to a source zone containing that external-facing interface. The attacker then sends crafted TCP traffic, commonly with a spoofed source address set to the intended victim. PAN-OS processes the traffic through the URL filtering policy and emits TCP responses toward the spoofed address. By repeating this at scale, the attacker turns the firewall into a reflector/amplifier, causing the victim to receive denial-of-service traffic that appears to originate from the firewall’s public IP address. The attacker benefits from obfuscation because abuse reports and network traces point to the firewall rather than to the true source.

How to fix it

Upgrade affected PAN-OS deployments to a vendor-fixed, supported PAN-OS release. If exact fixed versions are not tracked internally, use the current Palo Alto Networks advisory for CVE-2022-0028 and move to the latest maintenance release for the deployed PAN-OS branch. Cloud NGFW and Prisma Access were remediated by the vendor and generally require no customer software action for this issue. As an immediate mitigation, remove URL filtering profiles from security rules where the source zone includes an externally facing interface, especially Internet-facing or untrusted zones. URL filtering should normally be applied to outbound client traffic from internal/trusted zones, not inbound traffic sourced from the Internet. Review security policy for any blocked URL categories attached to external source zones and disable or redesign those policies. Where possible, apply anti-spoofing controls, ingress filtering, and upstream rate limiting to reduce abuse potential.

How to confirm the fix worked

Confirm the PAN-OS version is a fixed or later release according to the Palo Alto Networks advisory for this vulnerability. Review security policy and URL filtering profile assignments to ensure no URL filtering profile with blocked categories is attached to a rule whose source zone contains an externally facing interface. Validate that Cloud NGFW or Prisma Access tenants are covered by vendor-side remediation if applicable. From a monitoring perspective, verify that traffic logs do not show URL filtering block actions being applied to traffic sourced from untrusted or Internet-facing zones. If testing is required, perform only controlled validation in a lab or approved maintenance window and confirm that externally sourced traffic cannot cause the firewall to emit amplified TCP responses toward arbitrary third-party addresses.

Typical attack path

1. Locate an Internet-facing or otherwise externally reachable PAN-OS firewall interface.
2. Determine or assume that URL filtering is applied to the external source zone with at least one blocked URL category.
3. Send crafted TCP traffic to the firewall using the victim’s IP address as the spoofed source.
4. Trigger PAN-OS URL filtering behavior that generates reflected or amplified TCP responses.
5. Sustain or distribute the traffic to create a denial-of-service condition against the victim while making the firewall appear to be the attack source.

How to detect it

Look for evidence that a PAN-OS firewall acted as a reflector rather than for evidence of host compromise. Useful sources include PAN-OS traffic logs, URL filtering logs, threat logs, system logs, NetFlow/IPFIX, packet captures on external interfaces, upstream router telemetry, and ISP or third-party abuse reports. Investigate periods where a firewall interface generated unusual volumes of outbound TCP responses, especially SYN-ACK, RST, or other short-lived TCP traffic, to one or a small number of external destination IPs. Correlate those flows with inbound traffic from untrusted zones and URL filtering block activity on rules where the source zone is external-facing. Review configuration snapshots or audit logs for security rules that apply URL filtering profiles with blocked categories to Internet-facing source zones. Because exploitation uses spoofing and reflection, the true attacker source may not be visible in normal firewall logs; packet captures and upstream telemetry may be required. Indicators of prior abuse include third-party complaints naming the firewall public IP as a DoS source, sudden spikes in outbound packets from the firewall dataplane, and URL filtering block actions occurring on inbound or externally sourced traffic.

• block-url
• url-filtering
• URL filtering profile
• blocked category
• source zone untrust
• from untrust
• to untrust
• action eq block-url
• subtype eq url
• SYN-ACK flood
• TCP RST flood
• reflected amplification
• denial-of-service traffic from firewall public IP
• high-volume outbound TCP from firewall interface
• traffic log action=block-url
• traffic log subtype=url
• CVE-2022-0028

What your security team should do

• Prioritize remediation because the vulnerability is in CISA KEV, has documented active exploitation, and had a federal remediation deadline of 2022-09-12.
• Inventory all PAN-OS PA-Series, VM-Series, and CN-Series firewalls and identify versions and externally facing interfaces.
• Upgrade affected firewalls to a vendor-fixed supported PAN-OS release or the latest maintenance release for the active branch.
• Immediately audit URL filtering policy placement and remove URL filtering profiles from rules where the source zone includes Internet-facing or untrusted interfaces.
• Search historical firewall and network telemetry for signs that firewall public IPs emitted unusual high-volume TCP traffic to external destinations.
• Coordinate with network operations and upstream providers if firewall IP addresses appear in abuse complaints or DDoS reports.
• Implement or verify anti-spoofing and ingress/egress filtering controls consistent with BCP 38 where feasible.
• Document compensating controls for any firewall that cannot be upgraded immediately and track it to completion.