8 ms·
Palo Alto – Putting the Protecc in GlobalProtect (CVE-2024-3400)
- Wheaties466 2y agolike most products connected to the internet, VPNs and firewalls can have vulnerabilities too. As long as its not super low hanging fruit that should have been caught or is a bad default configuration, its the response that matters the most to me.
- katehikes88 2y agoBut it's the exploit of the week! How can you not be excited about shaming the company for this amazing fuck up! Positive feedback for is completely missing from the field. Instead security professionals mock developers and celebrate their human errors. This blog post is a good example of that. Everyone has vulnerabilities and security oopsies in their processes. Instead of cataloging individual vulnerabilities it would make sense to catalog the types of responses and claimed process improvements vendors and projects have.
- HoochTHX 2y agoI like the idea of that, that would allow us to judge a Product/Company based on a history of actions.
- kstrauser 2y agoThis was super low hanging fruit that should have been caught.
- redprince 2y ago> like most products connected to the internet, VPNs and firewalls can have vulnerabilities too. Except being exposed without protection to the hostile internet is their very reason to exist. I expect such devices to be developed with the awareness that they are going to be attacked by capable adversaries. Thus secure coding practices are to be followed and state of the art exploit mitigation techniques employed on the OS level. There's no excuse for high severity vulnerabilities to be found in these kinds of products.
- katehikes88 2y agoYou ought to adjust your expectations because they don't line up with reality. There is nothing particularly surprising or noteworthy about this vulnerability.
- Wheaties466 2y agotake a look at the history of pwn2own. It could be said that google chrome is one of the most actively developed projects period and people still find crazy 0 interaction exploits for this product. You just need to threat model around that and limit exposure in case something like this happens. Most orgs dont get hit with 0 days. Therefore the best thing you can do is patch often, when possible.
- fullspectrumdev 2y agoThe arb file write with uncontrolled (empty) content being turned into exec due to another process is certainly an interesting find. Usually arb file create bugs with no control of content are at best a DoS unless there’s another issue at play :)
- pizzalife 2y agoThe funny thing is that this isn't the first time PAN-OS is susceptible to RCE because of "arbitrary empty file creation" (directory in this case): https://seclists.org/fulldisclosure/2017/Dec/38 https://seclists.org/fulldisclosure/2017/Dec/38
- deathanatos 2y agoReally? I'd think truly arbitrary — root access to / — writes would be an RCE. Could you not just write out a cronjob, and wait for it to execute? Or change any common binary that would easily get invoked to do some "extra" work, etc.
- pizzalife 2y agoThese are not "truly arbitrary file creation" vulnerabilities. Turning those into RCE is trivial. This is about turning an empty file creation (0 bytes) or a directory creation into code execution, via buggy cron scripts etc that process filenames.
- hangonhn 2y agoThe combination of multiple bad behavior strung together is really interesting. I imagined the author of each bad behavior was unaware of the other bad behaviors and was basically like "what's the worst they can do?" I feel a lot of good exploits work this way where each small bad behavior can be leverages to magnify another.
- yrro 2y agoThis is what happens when 100 monkeys write code instead of 1 intelligent developer.
- K0HAX 2y agoYou know, when Linux admins say "don't run as root!" we don't only mean that users should not run as root. Nothing that doesn't absolutely have to should run as root. And before someone says "but only root can read those files!", please take this opportunity to learn about filesystem ACLs. https://linux.die.net/man/1/setfacl https://linux.die.net/man/1/setfacl edit: Also, yes, this would not have fully solved the problem, but it is very likely that the amount of potential harm that could have been caused would have been significantly reduced.
- SteveNuts 2y agoTangentially, the "disable selinux" as a first step for installing software is incredibly lazy in 2024. There are tools that help you analyze in permissive mode and easily convert the output to the contexts you need.
- K0HAX 2y agoI agree with this. I'm kind of appalled by the apparent lack of SELinux controls on a firewall that runs Linux under the hood. If I can run SELinux in enforcing mode on a Gentoo Desktop, any Linux administrator worthy of their job title can with a more enterprise/user friendly Linux distro too.
- doublepg23 2y agoWhile I do run SELinux on Fedora and RHEL, I gotta say the errors it produces just being I/O errors is incredibly frustrating.
- mmsc 2y agoSince Palo Alto are receiving all of this telemetry with GCP, couldn’t someone just send them terabytes of data to effectively DoS their bank account?
- deleted 2y ago[deleted]
- kstrauser 2y agoI just wrote this up elsewhere, but wow, is that Python code awful. It uses string interpolation to build a curl command line. Then it passes that string to a subprocess.Popen(cmd,shell=True). For those who don’t speak Python, that’s saying “run the string passed in here as a shell command exactly as if someone typed it into a bash prompt”. The right thing to to there would have been to create a list of arguments and pass that list in instead of a string, and set shell=False so that the list gets sent straight to the underlying syscall without being parsed and interpreted as a command line, with all the edge cases that brings. As worryingly, the free, open source Bandit Python static analyzer immediately flagged this code when I tested it locally. If Palo Alto had any kind of static analysis in their build pipeline, this would have failed. If they’re not doing that, what else are they not doing?
- yrro 2y agoCouldnt have put it better myself. The sheer incompetence is staggering and frankly it's depressing that these giant corporations are so good at selling their steaming piles of shit to companies who should really know better. If PAN-OS was open source then no one would want to be within 10,000 miles of it!
- kstrauser 2y agoIf it were open source, I could imagine sending some PRs there way, wishing them well, then running away to a safe distance. That this is the output of an $89B security company is mind boggling.
- FreakLegion 2y agoWhen I left PANW in the late 2010s the platform team was still on Python 2.6, I think, and the snippets in this write-up are valid 2.x code. It's very possible that this hasn't been touched in a decade beyond whatever was necessary to get to 3.6, which is itself 2+ years past its shelf date. That's a bigger and slightly more abstract problem than not running a mediocre linter.
- kstrauser 2y ago
- paulproteus 2y agoPeople are worried about `curl|bash` but not worried enough about C++ programs calling Python to call bash to call curl.
- dang 2y agoRecent and related: Palo Alto Networks PAN-OS Zero-Day Exploitation - https://news.ycombinator.com/item?id=40016985 https://news.ycombinator.com/item?id=40016985 - April 2024 (59 comments)
- neilv 2y agoA few days ago, a colleague saw a port/service scan: > User-Agent: Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com I could maybe see that for license enforcement, or for aggressively alerting users to the vulnerability even in absence of active service contracts. Could also be someone other than PAN, looking for vulnerable PAN boxes.
- kstrauser 2y agoEven if they honor that exactly as promised, I can't help imagining that email address being an alias for `audit@pan`. "Hey, who owns 12.34.56.78 that wouldn't want us seeing if they had our software running?"
- neilv 2y agoI would totally believe this is driven mainly by enterprise marketing, to get a foot in the occasional door where they haven't managed to otherwise, especially when they have the tool just sitting around. https://www.paloaltonetworks.com/cortex/cortex-xpanse https://www.paloaltonetworks.com/cortex/cortex-xpanse