CVE-2024-9465

What it actually does

CVE-2024-9465 is an unauthenticated SQL injection vulnerability in Palo Alto Networks Expedition. By sending crafted requests to the vulnerable application, an attacker can manipulate backend SQL queries and extract database contents including usernames, password hashes, firewall/device configurations, and device API keys. The vulnerability also enables creation and reading of arbitrary files on the Expedition host, which can expand impact from data theft to local file manipulation and potential follow-on compromise depending on system configuration and exposed credentials.

Why it matters to the business

A successful compromise can expose sensitive firewall migration data, administrator usernames, password hashes, device configurations, and API keys that may allow attackers to pivot into managed Palo Alto Networks devices or broader network infrastructure. Because this vulnerability is listed in CISA KEV, has very high EPSS likelihood, and is reported as actively exploited in the wild, internet-exposed or unpatched Expedition systems should be treated as high-priority incident-risk assets. The CISA KEV remediation deadline was 2024-12-05, so systems still vulnerable after that date represent a significant compliance and operational risk.

How an attack unfolds

An attacker first identifies an exposed Palo Alto Networks Expedition instance. Without authenticating, the attacker sends crafted input to a vulnerable endpoint that is incorporated unsafely into SQL queries. The injected SQL allows the attacker to enumerate and dump database tables containing application users, password hashes, device configuration data, and stored API keys. The attacker can then use extracted credentials or API keys to access managed devices or other administrative interfaces. In addition, the attacker may abuse the vulnerability’s file read/write capability to create or retrieve files on the Expedition system, potentially staging tools, extracting local secrets, or preparing persistence depending on permissions and system hardening.

How to fix it

Upgrade Palo Alto Networks Expedition to a vendor-fixed release that addresses CVE-2024-9465, following Palo Alto Networks’ official advisory and upgrade instructions. If a fixed version is not immediately available or the product is no longer required, remove Expedition from service. Restrict Expedition access to trusted administrative networks only; do not expose it to the internet. Rotate all credentials, password hashes, API keys, device keys, and secrets stored in or processed by Expedition because database disclosure should be assumed if the system was exposed while vulnerable. Review and re-import device configurations only after validating integrity. Apply least privilege to Expedition service accounts and API tokens, and ensure host-level file permissions prevent unnecessary read/write access.

How to confirm the fix worked

Confirm that all Expedition instances are running a vendor-fixed version or have been decommissioned. Verify that no Expedition web interface is reachable from the public internet and that access is limited by firewall, VPN, or other administrative controls. Conduct authenticated version checks and compare against the vendor advisory. Run vulnerability scanners capable of identifying CVE-2024-9465 exposure, but avoid destructive SQL injection testing in production. Validate that previously stored device API keys, local application credentials, and imported configuration secrets have been rotated. Review web access logs for suspicious unauthenticated requests containing SQL metacharacters, UNION SELECT patterns, time-based SQL injection functions, or attempts to read or write files.

Typical attack path

1. Scan for exposed Palo Alto Networks Expedition web interfaces.
2. Fingerprint the Expedition version or vulnerable behavior.
3. Send unauthenticated crafted SQL injection payloads to the vulnerable endpoint.
4. Enumerate database schema and extract usernames, password hashes, device configurations, and API keys.
5. Use recovered API keys or cracked password hashes for access to managed network devices or administrative services.
6. Read sensitive files from the Expedition host or create attacker-controlled files where permitted.
7. Pivot to downstream firewall management, network infrastructure, or credentialed services using stolen secrets.

How to detect it

Review Expedition web server logs, application logs, database logs, and system audit logs for evidence of unauthenticated SQL injection attempts or abnormal file access. Focus on requests containing SQL keywords, stacked query separators, URL-encoded SQL syntax, time-delay functions, UNION-based extraction, or attempts to write files. Examine database logs for unexpected schema enumeration, large SELECT queries, access to user or configuration tables, or errors caused by malformed SQL. Check filesystem metadata for newly created or modified files owned by the web server or application user, especially in web-accessible directories and temporary locations. Review outbound network connections from the Expedition host for unusual destinations after suspicious requests. Investigate subsequent authentication to managed Palo Alto Networks devices using API keys or credentials that were stored in Expedition. Because active exploitation is reported, treat suspicious SQL injection patterns against exposed Expedition systems as potential compromise rather than mere scanning.

• UNION SELECT
• UNION%20SELECT
• SLEEP(
• SLEEP%28
• BENCHMARK(
• BENCHMARK%28
• INFORMATION_SCHEMA
• information_schema
• SELECT @@version
• SELECT%20@@version
• OR 1=1
• OR%201%3D1
• ' OR '1'='1
• %27%20OR%20%271%27%3D%271
• -- -
• %2D%2D%20%2D
• ; SELECT
• %3B%20SELECT
• INTO OUTFILE
• INTO%20OUTFILE
• LOAD_FILE(
• LOAD_FILE%28
• /var/www/html
• /tmp/
• /etc/passwd
• /etc/shadow
• /home/userSpace/
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/nginx/access.log
• /var/log/nginx/error.log

What your security team should do

• Immediately inventory all Palo Alto Networks Expedition instances, including migration or lab systems that may have been left online.
• Prioritize remediation as urgent because the vulnerability is in CISA KEV, has active exploitation, and has an EPSS score near 1.0.
• Patch to the vendor-fixed Expedition release or decommission the product if it is no longer operationally required.
• Remove public internet exposure and restrict access to trusted administrative networks.
• Assume stored Expedition secrets may be compromised on any exposed vulnerable system; rotate device API keys, administrator passwords, service credentials, and related secrets.
• Review Expedition database, web, and system logs for exploitation attempts and successful data extraction.
• Hunt for use of stolen API keys against managed Palo Alto Networks devices and related management interfaces.
• Preserve forensic images and logs before rebuilding systems where compromise is suspected.
• Rebuild compromised Expedition hosts from trusted media rather than relying only on in-place cleanup.
• Monitor vendor and CISA guidance for updates, exploit details, and additional indicators.