CVE-2024-9464

What it actually does

CVE-2024-9464 is an authenticated OS command injection vulnerability in Palo Alto Networks Expedition. A user who can authenticate to Expedition can inject operating-system commands through vulnerable application functionality and have those commands executed with root privileges on the Expedition host. Successful exploitation can expose Expedition-stored firewall migration data, including usernames, cleartext passwords, PAN-OS firewall configurations, and device API keys, and can also allow the attacker to modify files, create persistence, pivot through network access available to Expedition, or use stolen firewall credentials against managed PAN-OS devices.

Why it matters to the business

Compromise of Expedition can turn a migration or management utility into a source of privileged firewall credentials and sensitive network configuration data. An attacker may be able to steal administrator credentials and API keys, understand network topology and security policy, alter migration data, or use the Expedition server as a stepping stone toward PAN-OS firewalls. Although the flaw requires authentication, the EPSS score is very high and exploit maturity is weaponized, so exposed or weakly protected Expedition instances should be treated as high-priority assets even though the CVSS score is moderate.

How an attack unfolds

An attacker first obtains valid Expedition credentials through phishing, credential reuse, previously leaked passwords, or another Expedition vulnerability. After logging in, the attacker sends a crafted request to the vulnerable Expedition functionality with shell metacharacters or command-substitution syntax embedded in a parameter that the application passes to the operating system unsafely. Expedition executes the attacker-supplied command as root. The attacker can then enumerate local files, dump application data, retrieve stored PAN-OS usernames and cleartext passwords, extract firewall configuration exports and API keys, and optionally deploy persistence or tooling. With those secrets, the attacker may attempt to authenticate to managed firewalls, download or modify configurations, create new API keys or accounts where permitted, and expand access across the network.

How to fix it

Upgrade Palo Alto Networks Expedition to a vendor-fixed release or the latest available supported version. If Expedition is no longer required, decommission it. If an immediate upgrade is not possible, restrict access to trusted administrative networks or a VPN, block internet exposure, enforce strong unique authentication and MFA where available, and monitor all Expedition activity closely. Because successful exploitation can disclose credentials and API keys, remediation should include rotating Expedition local credentials, PAN-OS firewall administrator passwords, device API keys, and any other secrets stored in or imported into Expedition. Review Expedition projects and exported configurations for unauthorized access or modification. Remove unnecessary accounts and ensure the Expedition host is not granted broader network reachability than needed.

How to confirm the fix worked

Confirm the installed Expedition version is a vendor-fixed or latest supported release according to Palo Alto Networks advisories. Verify that Expedition is not reachable from untrusted networks and that access controls restrict it to approved administrators. Attempt authenticated negative testing using safe command-injection metacharacters in non-production or authorized test conditions and confirm commands are not executed. Review package/application version information, web application behavior, and vendor vulnerability checks from an authenticated scanner. Validate that all previously stored firewall credentials and API keys have been rotated and that old keys no longer authenticate to PAN-OS devices.

Typical attack path

1. Identify an internet-facing or internally reachable Palo Alto Networks Expedition instance.
2. Acquire or reuse valid Expedition credentials.
3. Authenticate to the Expedition web interface or API.
4. Send a crafted request containing OS command-injection payloads to the vulnerable Expedition function.
5. Gain root-level command execution on the Expedition server.
6. Enumerate Expedition files, databases, logs, migration projects, and stored device credentials.
7. Exfiltrate PAN-OS firewall configurations, usernames, cleartext passwords, and API keys.
8. Use stolen firewall credentials or API keys to access managed PAN-OS devices or other infrastructure.
9. Optionally establish persistence, remove evidence, or use the Expedition host for lateral movement.

How to detect it

Investigate both the Expedition application layer and the underlying Linux host. Review Apache or web-server access logs for authenticated requests containing shell metacharacters, command substitution, encoded payloads, or suspicious utility names such as curl, wget, bash, sh, nc, python, perl, or base64. Correlate suspicious requests with Expedition user logins, source IP addresses, session identifiers, and timestamps. On the host, inspect process execution telemetry for web-server or application service accounts spawning shells or command-line tools, especially commands executed as root. Review /var/log/auth.log, /var/log/syslog, web error logs, shell histories, cron locations, systemd unit files, /tmp, /var/tmp, and web-accessible directories for persistence or dropped tools. Examine Expedition project data, database exports, and file access times for unusual reads of stored credentials, PAN-OS configurations, and API keys. Review PAN-OS firewall logs for subsequent logins, API calls, configuration downloads, or configuration changes from the Expedition host or from unfamiliar IP addresses using accounts or keys stored in Expedition.

• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/auth.log
• /var/log/syslog
• /bin/sh -c
• /bin/bash -c
• bash -c
• sh -c
• www-data
• apache2
• ;id
• ; whoami
• ;uname -a
• $(id)
• `id`
• |id
• && id
• curl http
• wget http
• nc -e
• ncat -e
• python -c
• perl -e
• base64 -d
• chmod +x /tmp
• /tmp/
• /var/tmp/
• /etc/cron.d/
• /etc/systemd/system/

What your security team should do

• Treat authenticated access to Expedition as sensitive administrative access and prioritize patching or decommissioning due to weaponized exploitation and high EPSS likelihood.
• Immediately identify all Expedition instances, especially those exposed to the internet or broad internal networks.
• Upgrade to the latest vendor-fixed Expedition release or remove Expedition if it is not operationally required.
• Restrict Expedition access to trusted administrative sources only; place it behind VPN or equivalent controls.
• Rotate all credentials and API keys stored in Expedition, including PAN-OS firewall administrator passwords and device API keys.
• Review Expedition audit logs, Apache/web logs, authentication logs, and shell/process history for evidence of command execution or credential access.
• Hunt for follow-on access to PAN-OS firewalls using credentials or API keys that were stored in Expedition.
• Remove stale Expedition users, enforce unique passwords, and enable MFA or compensating identity controls where possible.
• Create detections for suspicious command-injection characters in authenticated Expedition HTTP requests and for web-server-spawned shell processes.
• If compromise is suspected, preserve the Expedition host for forensic analysis before rebuilding from trusted media.