Palo Alto PAN-OS Flaws Exploited to Gain Administrator Access
Summary
Attackers are exploiting chained PAN-OS authentication-bypass and privilege-escalation flaws to gain administrator access. Wiz observed web shells, Sliver implants and crypto miners; ShadowServer reported at least 2,000 compromised instances.
Key points
- CVE-2024-0012 bypasses authentication on the PAN-OS management interface; CVE-2024-9474 can then escalate privileges, enabling unauthenticated remote code execution when chained.
- Palo Alto and other organizations observed exploitation beginning in November 2024; activity reportedly increased after a proof-of-concept was published.
- ShadowServer reported at least 2,000 compromised instances worldwide.
- Wiz observed interactive command execution and deployments of web shells, Sliver implants and crypto miners; some apparent dummy payloads may have resulted from proof-of-concept scanning.
- Wiz reported reuse of a Sliver implant communicating with 77.221.158[.]154 and described possible links to compromised web servers, while noting it could not confirm a shared actor.
- Wiz reported vulnerable PAN-OS devices in 24% of cloud enterprise environments it assessed, with internet-facing, unauthenticated-exploitable devices in 7% of those environments.
- Upgrade to a patched PAN-OS version and restrict management-interface access to trusted IP addresses; check devices for signs of prior exploitation.
Article Details
- Vulnerability Types
- Authentication bypass
- Privilege escalation
- Unauthenticated remote code execution when chained
- Severity
- Critical
- Affected Versions
- PAN-OS 11.2 < 11.2.4-h1
- PAN-OS 11.1 < 11.1.5-h1
- PAN-OS 11.0 < 11.0.6-h1
- PAN-OS 10.2 < 10.2.12-h2
- PAN-OS versions before 10.1.14-h6 (CVE-2024-9474)
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Restrict access to the management interface to trusted IP addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | censysinspect[.]com | Reported to have served as a C2 address for Sliver implants; the article says it has since been parked. |
| IPV4 | 77[.]221[.]158[.]154 | Identified as the C2 address used by a reused Sliver implant. |
| SHA1 | 90f6890fa94b25fbf4d5c49f1ea354a023e06510 | Hash identified by Wiz Threat Research as Specter-C (Botnet) in attacks exploiting CVE-2024-0012. |
| SHA1 | 9a7355565ff9d84e1c61e2174ea1a54358f9628f | Hash identified by Wiz Threat Research as PHPWebshell in attacks exploiting CVE-2024-0012. |
| SHA1 | af817679227921768e15a3a5971b263d5fcf6f75 | Hash identified by Wiz Threat Research as DaggerFly (Trojan.Linux) in attacks exploiting CVE-2024-0012. |
| SHA1 | b4378712adf4c92a9da20c0671a06d53cbd227c8 | Hash of a Sliver implant observed being reused in attacks. |
| SHA1 | c1dcbf5816f93038313655f1a99f5efc847c637b | Hash identified by Wiz Threat Research as PHPWebshell in attacks exploiting CVE-2024-0012. |
| SHA1 | c63f646edfddb4232afa5618e3fac4eee1b4b115 | Hash identified by Wiz Threat Research as an XMRig Miner in attacks exploiting CVE-2024-0012. |
| SHA1 | caae3165bda2e4434f487dee30e39a92e808bfbc | Hash identified by Wiz Threat Research as DaggerFly (Trojan.Linux) in attacks exploiting CVE-2024-0012. |
| SHA1 | e9cd4829b3e64f2f6f45e2761d474f213009d4c8 | Hash identified by Wiz Threat Research as DaggerFly (Trojan.Linux) in attacks exploiting CVE-2024-0012. |
| SHA1 | fca6e83abce58e47e247bee3ebaef3fc4ad89e75 | Hash identified by Wiz Threat Research as PHPWebshell in attacks exploiting CVE-2024-0012. |
MITRE ATT&CK
T1105 · Ingress Tool TransferObserved activity included deploying malicious payloads, including Sliver implants, to compromised devices.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in the PAN-OS management interface, including on internet-facing devices.T1496 · Resource HijackingCrypto miners were deployed on some compromised devices.T1505.003 · Web ShellThreat actors deployed web shells on compromised PAN-OS devices.
CVE
CVE-2024-0012they later confirmed their active exploitation: the first vulnerability is an authentication bypass (CVE-2024-0012) and the second is a privilege escalation vulnerability (CVE-2024-9474). CVE-2024-9474is an authentication bypass (CVE-2024-0012) and the second is a privilege escalation vulnerability (CVE-2024-9474).
Threat Actors
Malware
DaggerFlye9cd4829b3e64f2f6f45e2761d474f213009d4c8 DaggerFly (Trojan.Linux)MgBotDaggerfly is known for exclusively using MgBot malware and has likely been involved in multiple supply chain infection campaigns.PHPWebshellfca6e83abce58e47e247bee3ebaef3fc4ad89e75 PHPWebshellSliverexploit. In several cases we observed, the threat actors abused their access to deploy web shells, Sliver implants and/or crypto miners. Specter-C90f6890fa94b25fbf4d5c49f1ea354a023e06510 Specter-C (Botnet)XMRig Minerc63f646edfddb4232afa5618e3fac4eee1b4b115 XMRig Miner
Vendors
Products
Tools
Metasploit FrameworkRapid7 Metasploit module Nucleicloud environments and active unauthenticated scanning using the Wiz Dynamic Scanner, based on this Nuclei template originally published by watchTowr. We can confirm that this template accurately detectsSliverexploit. In several cases we observed, the threat actors abused their access to deploy web shells, Sliver implants and/or crypto miners.