CVE-2024-3400: patch GlobalProtect or take it offline

CVE-2024-3400 is a command-injection vulnerability in PAN-OS, tracked by Palo Alto Networks in the advisory published 12 April 2024. It applies when GlobalProtect gateway or GlobalProtect portal is enabled. NVD and the vendor scored it 10.0. CISA added it to the exploited catalog as soon as the advisory was public, because exploitation had started before the patches.

The vendor's instruction, while fixes were still rolling per release train, was to apply the hotfix for your PAN-OS branch or disable GlobalProtect if you could not. Threat briefings that month described implants on compromised firewalls. This note does not describe the request.

Which firewalls were in scope

PAN-OS with GlobalProtect gateway or portal enabled. Firewall features that do not expose GlobalProtect were outside the advisory's condition. A device that only does east-west filtering and has the portal switched off was not the target configuration. Many devices had the portal on because remote access is why the box was bought.

Cloud-delivered services that are not a PAN-OS firewall you operate were not the thing to hotfix yourself. The appliance in the rack, and the virtual firewall in the account you pay for, were.

What a shell on the firewall is

The firewall sees the traffic you asked it to see, and it holds the credentials of the VPN users who terminate there. A command injection at that position is not a crashed process. It is a host on the management side of the network, with a view of remote-access sessions.

Public reporting after 12 April described follow-on tools left on devices. If your GlobalProtect was exposed and unpatched in that window, treat the device as untrusted until you can show the hotfix was already installed. Export logs off the box before you rebuild it.

Follow the vendor advisory, not a copied version list

Palo Alto shipped hotfixes across the supported PAN-OS trains and updated the advisory as later maintenance releases absorbed them. The page for CVE-2024-3400 is the list. A version number remembered from a blog in April 2024 can be short of the hotfix that actually contained the fix for your train.

If the device is on a train that is end of life, the advisory's answer is to upgrade to a supported train, not to wait for a hotfix that will not come. Disabling GlobalProtect removes the condition the advisory names. Do that only if remote access can stop, and turn it back on only after the fixed build is running.

Patch, then decide if the device is still yours

Apply the hotfix from the advisory, reboot if the upgrade requires it, and confirm the PAN-OS version on the device matches a fixed build. Do both members of a high-availability pair. Restrict the management interface to a network that is not the same path as GlobalProtect.

For a device that was exposed and late, preserve logs, rotate credentials stored on it, and prefer a rebuild over a cleanup you cannot verify. Send firewall logs to a collector the device does not administer. The advisory URL is the change-ticket link.

Palo Alto Networks advisory for CVE-2024-3400, disclosed 12 April 2024.

https://security.paloaltonetworks.com/CVE-2024-3400