CVE-2024-9463

What it actually does

CVE-2024-9463 is an unauthenticated OS command injection flaw in Palo Alto Networks Expedition. A remote attacker can send crafted input to the Expedition web application that is interpreted as operating-system commands. Those commands execute as root on the Expedition host, giving the attacker full control of the appliance and access to locally stored migration data, including firewall usernames, cleartext passwords, device configurations, and PAN-OS API keys.

Why it matters to the business

Successful exploitation can turn a migration utility into a credential-theft and firewall-compromise foothold. Because Expedition commonly stores sensitive firewall configuration and access material, compromise can expose network security policy, enable unauthorized firewall administration, support lateral movement into managed firewall environments, and require broad credential and API-key rotation. This vulnerability is listed in CISA KEV, has observed exploitation in the wild, and had a CISA remediation deadline of 2024-12-05, so any remaining exposure should be treated as urgent.

How an attack unfolds

An attacker first identifies an internet-accessible or otherwise reachable Expedition instance. Because authentication is not required, the attacker sends a specially crafted request containing command-injection syntax to a vulnerable Expedition component. Expedition passes attacker-controlled input to the underlying operating system, causing arbitrary commands to run as root. The attacker can then enumerate the host, dump Expedition application files and databases, collect firewall migration projects, retrieve usernames, cleartext passwords, API keys, and device configuration exports, and exfiltrate that data. With the harvested material, the attacker may attempt to access managed PAN-OS firewalls, modify security policy, create new administrative access, disable controls, or use the Expedition host as a staging point for additional internal reconnaissance.

How to fix it

Upgrade Palo Alto Networks Expedition to a vendor-fixed release; Palo Alto Networks fixed this issue in Expedition 1.2.96 and later. If Expedition is no longer required, shut it down and decommission it rather than leaving it reachable. Restrict Expedition access to trusted administrative networks only, place it behind VPN or equivalent access control, and block internet exposure. After patching, assume stored secrets may have been exposed: rotate all firewall administrator passwords, API keys, service credentials, and any credentials stored in Expedition projects; review firewall configurations for unauthorized changes; and remove stale migration projects or exported configuration files. If immediate patching is not possible, isolate the host, disable external access, and monitor heavily, but do not treat network restriction as a substitute for upgrading.

How to confirm the fix worked

Confirm the installed Expedition version is 1.2.96 or later or otherwise marked fixed by Palo Alto Networks. Verify the Expedition web interface is not reachable from the public internet and is only accessible from approved administrative networks. Review package, application, and service inventory to ensure no legacy Expedition instances remain. Use vendor guidance or a safe authenticated vulnerability scanner to validate the patch level; avoid destructive exploit testing against production systems. After remediation, validate that previously stored firewall credentials and API keys have been rotated and that managed PAN-OS devices no longer accept old credentials. Check web and system logs for historical exploitation before declaring the issue closed.

Typical attack path

1. Scan for exposed Palo Alto Networks Expedition web interfaces.
2. Confirm the target is a vulnerable Expedition version or responds like an unpatched instance.
3. Send an unauthenticated crafted HTTP request containing OS command-injection syntax.
4. Execute reconnaissance commands on the Expedition host as root.
5. Dump local Expedition data stores, project files, firewall configuration exports, usernames, passwords, and API keys.
6. Exfiltrate collected configuration and credential material.
7. Use harvested firewall credentials or API keys to access managed PAN-OS devices or other connected systems.
8. Optionally deploy persistence, additional tooling, or cleanup commands to hide activity.

How to detect it

To determine whether exploitation already occurred, review Expedition web server access and error logs, system authentication logs, shell history, process execution telemetry, EDR alerts, and outbound network connections from the Expedition host. Focus on unauthenticated HTTP requests containing command separators, URL-encoded shell metacharacters, command-substitution syntax, or payloads invoking shells and download tools. Investigate web server processes spawning shell interpreters or utilities such as bash, sh, curl, wget, nc, python, perl, or openssl. Look for unexpected archive files, credential dumps, database exports, firewall configuration exports, and outbound transfers shortly after suspicious HTTP requests. Because compromise exposes firewall credentials and API keys, also review PAN-OS device logs for unusual API calls, administrative logins from new source IPs, configuration exports, new accounts, policy changes, commit operations, or disabled logging. If threat intelligence, EDR, or firewall telemetry shows exploitation attempts against Expedition during or after October 2024, correlate those timestamps with host process activity and outbound traffic.

• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/nginx/access.log
• /var/log/nginx/error.log
• /var/log/auth.log
• /var/log/syslog
• %3B
• %7C
• %26%26
• %60
• %24%28
• ;cat%20/etc/passwd
• /bin/sh
• /bin/bash
• bash -c
• sh -c
• curl http
• wget http
• chmod +x
• nc -e
• ncat -e
• python -c
• perl -e
• /tmp/
• /var/tmp/
• tar czf
• zip -r
• mysqldump
• whoami
• id
• uname -a
• cat /etc/passwd
• cat /etc/shadow

What your security team should do

• Immediately identify all Palo Alto Networks Expedition instances, including temporary migration servers and dormant appliances.
• Patch to Expedition 1.2.96 or later, or decommission the system if it is not actively required.
• Treat any vulnerable internet-accessible Expedition instance as potentially compromised due to KEV listing, active exploitation, and very high EPSS likelihood.
• Rotate all credentials and API keys stored in Expedition, including PAN-OS firewall administrator passwords and device API keys.
• Review managed firewall audit logs for new administrators, policy changes, configuration exports, API activity, and log-clearing attempts after possible exposure.
• Hunt Expedition hosts for evidence of command execution, webshells, unfamiliar binaries, reverse shells, data staging archives, and suspicious outbound connections.
• Restrict Expedition access to VPN or administrative jump hosts and enforce network-layer allowlisting.
• Preserve logs and forensic images before rebuilding or decommissioning any suspected compromised Expedition host.