CVE-2024-3400

What it actually does

This is an unauthenticated remote command-injection vulnerability in the GlobalProtect feature of vulnerable Palo Alto Networks PAN-OS firewalls. By abusing arbitrary file creation in specific GlobalProtect configurations, an attacker can cause attacker-controlled input to be interpreted as operating-system commands. Successful exploitation gives the attacker root-level code execution on the firewall, enabling full compromise of the appliance, access to configuration and secrets, traffic interception opportunities, persistence, and use of the firewall as a pivot point. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted according to the vendor description.

Why it matters to the business

Compromise of an internet-facing firewall can become a high-impact business incident because the device often protects remote access, network segmentation, and perimeter traffic. An attacker with root access may steal VPN credentials, export firewall configuration, disable security controls, create persistence, move laterally into internal networks, disrupt connectivity, or support ransomware operations. This vulnerability is in CISA KEV, has been exploited in the wild, is associated with ransomware activity, has an EPSS near 1.0, and had a federal remediation deadline of 2024-04-19, so exposed systems should be treated as urgent incident-response priorities rather than routine patching tasks.

How an attack unfolds

An attacker first identifies an internet-exposed PAN-OS firewall with GlobalProtect portal or gateway functionality enabled and running a vulnerable PAN-OS release. The attacker sends crafted unauthenticated requests to the GlobalProtect interface that abuse arbitrary file creation, typically involving attacker-controlled path or session values. The created file or filename is then processed by a privileged PAN-OS component in a way that results in command execution. Once code runs as root, the attacker commonly stages shell commands, retrieves payloads using built-in tools such as curl or wget, modifies files for persistence, collects configuration and credential material, and may establish a backdoor or use the firewall as a launch point into the protected network. Public reporting has associated exploitation with campaigns targeting PAN-OS GlobalProtect appliances, including post-exploitation activity such as web-shell/backdoor deployment, data theft, and ransomware-enabling access.

How to fix it

Upgrade affected PAN-OS firewalls to a vendor-fixed PAN-OS release immediately. For PAN-OS, fixed releases include the vendor hotfix branches for 10.2, 11.0, and 11.1, including 10.2.9-h1 or later, 11.0.4-h1 or later, and 11.1.2-h3 or later; use the latest vendor-recommended maintenance release for the deployed branch. If immediate upgrade is not possible, apply Palo Alto Networks’ documented interim mitigations, including disabling affected telemetry/configuration paths where applicable and applying relevant Threat Prevention content signatures if licensed and enabled, but do not treat mitigation as a substitute for patching. Restrict GlobalProtect management and portal/gateway exposure to only required source networks where operationally feasible. After any suspected exposure, perform incident response: collect a technical support file, preserve logs, check for indicators of compromise, rotate administrator passwords, VPN credentials, API keys, certificates, and other secrets that may have been stored on or accessible from the firewall, and review downstream systems for lateral movement. Ignore unrelated package metadata such as non-PAN-OS source-code commit references when remediating PAN-OS appliance exposure; remediation must be based on the PAN-OS version and GlobalProtect configuration.

How to confirm the fix worked

Confirm the firewall is running a fixed PAN-OS hotfix or later release for its branch and that GlobalProtect exposure has been reviewed. Verify the installed PAN-OS version from the device UI, CLI, or centralized asset inventory and compare it against Palo Alto Networks’ advisory-fixed versions. Validate whether GlobalProtect portal or gateway is enabled and internet-accessible; if it is not required, confirm it is disabled or access-restricted. Confirm applicable Threat Prevention content and vendor mitigations are active where used as temporary controls. Run exposure scans from an external vantage point to ensure only intended GlobalProtect services are reachable. For previously exposed devices, validate remediation by reviewing logs and filesystem artifacts for exploitation patterns, confirming no unauthorized files or modified startup/persistence mechanisms remain, and ensuring all sensitive credentials and certificates potentially accessible from the firewall have been rotated.

Typical attack path

1. Scan the internet for exposed PAN-OS GlobalProtect portals or gateways.
2. Fingerprint PAN-OS behavior to identify likely vulnerable versions or configurations.
3. Send unauthenticated crafted requests to the GlobalProtect endpoint to trigger arbitrary file creation.
4. Cause the created artifact or filename to be processed by PAN-OS in a command-execution context.
5. Execute commands with root privileges on the firewall.
6. Download or stage payloads, often using native utilities such as curl, wget, sh, or bash.
7. Collect firewall configuration, VPN-related secrets, certificates, local data, and network information.
8. Install persistence or a backdoor and attempt to evade cleanup.
9. Pivot from the firewall into internal networks or use the device to support credential theft, data exfiltration, or ransomware deployment.

How to detect it

To determine whether exploitation already occurred, collect a Palo Alto Networks technical support file and review GlobalProtect, system, traffic, threat, and web/SSLVPN-related logs covering at least the exposure window from before publication through remediation. Search for crafted unauthenticated requests to GlobalProtect endpoints, especially unusual SESSID cookie values, path traversal strings, and log entries indicating failed session unmarshalling. Review /var/log/pan/sslvpn_ngx_error.log and related GlobalProtect service logs for anomalous session parsing errors. Hunt the appliance filesystem, where supported by vendor tooling or forensic acquisition, for unexpected files under GlobalProtect web directories, modified Python .pth files, unexpected scripts, new cron or startup persistence, and files created around suspicious request timestamps. Look for child shell execution from PAN-OS web or GlobalProtect processes, use of curl/wget from the appliance, outbound connections from the firewall to unfamiliar internet hosts, and unexpected configuration exports. In SIEM, correlate inbound requests to GlobalProtect with subsequent outbound connections from the firewall, administrative logins from unusual sources, VPN authentication anomalies, and configuration changes. If any indicator is present, handle the firewall as compromised: preserve evidence, isolate or replace the device as appropriate, rotate secrets, and hunt internal systems for lateral movement or ransomware staging.

• failed to unmarshal session
• SESSID=../
• SESSID=../../
• SESSID=/../../../
• /var/log/pan/sslvpn_ngx_error.log
• /var/appweb/sslvpndocs/global-protect/portal/
• /var/appweb/sslvpndocs/global-protect/portal/css/
• /var/appweb/sslvpndocs/global-protect/portal/images/
• /usr/lib/python3.6/site-packages/system.pth
• system.pth
• global-protect/portal/css/
• global-protect/portal/images/
• /bin/sh -c
• /bin/bash -c
• wget -qO-
• curl -k
• curl -o
• device_telemetry
• sslvpnd
• gpsvc

What your security team should do

• Treat every internet-facing vulnerable PAN-OS GlobalProtect appliance as potentially compromised until investigated, because exploitation is active, unauthenticated, reliable, and ransomware-associated.
• Immediately upgrade to a vendor-fixed PAN-OS release, prioritizing systems with GlobalProtect portal or gateway exposed to the internet.
• If patching cannot be completed immediately, apply vendor mitigations, restrict access to GlobalProtect, and deploy relevant Threat Prevention signatures, then schedule emergency upgrade as soon as possible.
• Collect and preserve forensic evidence before rebooting or rebuilding: technical support files, system logs, traffic logs, GlobalProtect logs, process listings where available, configuration snapshots, and relevant packet captures.
• Hunt for exploitation using GlobalProtect request logs, sslvpn/nginx error logs, system logs, suspicious file creation, unexpected shell execution, and outbound connections from the firewall.
• Rotate credentials and secrets that may have been exposed, including local admin accounts, directory bind accounts, VPN-related credentials, API keys, certificates, and shared secrets.
• Review firewall policy, administrator accounts, scheduled tasks, certificates, and configuration changes for unauthorized modifications.
• Investigate adjacent network segments for lateral movement originating from the firewall or using credentials stored on the firewall.
• Increase monitoring on VPN authentication, unusual administrator logins, configuration exports, and outbound traffic from firewall management or data-plane interfaces.
• Track vendor updates and threat-intelligence reporting for new indicators, tooling, and post-exploitation behaviors related to PAN-OS GlobalProtect exploitation campaigns.