At the moment, CISA warned that attackers are exploiting a crucial lacking authentication vulnerability in Palo Alto Networks Expedition, a migration instrument that may assist convert firewall configuration from Checkpoint, Cisco, and different distributors to PAN-OS.
This safety flaw, tracked as CVE-2024-5910, was patched in July, and risk actors can remotely exploit it to reset software admin credentials on Web-exposed Expedition servers.
“Palo Alto Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data,” CISA says.
Whereas the cybersecurity company has but to supply extra particulars on these assaults, Horizon3.ai vulnerability researcher Zach Hanley launched a proof-of-concept exploit in October that may assist chain this admin reset flaw with a CVE-2024-9464 command injection vulnerability (patched final month) to achieve “unauthenticated” arbitrary command execution on weak Expedition servers.
CVE-2024-9464 will be chained with different safety flaws (additionally addressed by Palo Alto Networks in October) to take over firewall admin accounts and hijack PAN-OS firewalls.
Admins who cannot instantly set up safety updates to dam incoming assaults are suggested to limit Expedition community entry to licensed customers, hosts, or networks.
“All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating,” the corporate cautions.
Palo Alto Networks has but to replace its safety advisory to warn prospects of ongoing CVE-2024-5910 assaults.
CISA additionally added the vulnerability to its Identified Exploited Vulnerabilities Catalog on Thursday. As required by the binding operational directive (BOD 22-01) issued in November 2021, U.S. federal businesses should now safe weak Palo Alto Networks Expedition servers on their networks in opposition to assaults inside three weeks, by November 28.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the cybersecurity company warned.
