CVE-2024-5916: Information Exposure Vulnerability in Palo Alto Networks PAN-OS Software Discloses Secrets, Passwords, and Tokens of External Systems

A recently discovered information exposure vulnerability (CVE-2024-5916) found in Palo Alto Networks PAN-OS software allows a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. In this post, we will go through the details of this vulnerability, along with its exploit, and discuss how a read-only administrator with access to the config log can read confidential data.

CVE-2024-5916 – Information Exposure Vulnerability in PAN-OS Software

Palo Alto Networks, a leading cybersecurity company, provides robust security platforms through its PAN-OS software. This operating system is responsible for the management and security of the networks on Palo Alto's products. However, this critical information exposure vulnerability (CVE-2024-5916) found in PAN-OS software could pose a severe threat to the confidentiality of information.

Exploit Details

The vulnerability exists due to a misconfiguration in the logging feature of PAN-OS software. When a local system administrator performs certain configuration changes, the config log records these changes and exposes confidential data related to secrets, passwords, and tokens of external systems. This sensitive data can be seen by a read-only administrator with access to the log files, leading to potential unintended disclosure of secrets, passwords, and tokens.

To exploit this vulnerability, an attacker would need to have access to the config log, which is usually available only to read-only administrators. Alternatively, an attacker may attempt to gain unauthorized access to the logs through a separate exploit or use social engineering techniques to trick a read-only administrator into providing the log data.

The following code snippet illustrates how the sensitive information can be exposed in the config log files:

PAN-OS Config Log:

<modification>
  <timestamp>2021-11-30T10:15:24</timestamp>
  <username>example-admin</username>
  <remote_addr>192..2.55</remote_addr>
  <newvalue><![CDATA[integrationconfig={
  "authToken":"ThisIsNotAnAuthToken",
  "ftpPassword":"MySuperSecretPassword" }
 ]]></newvalue>
</modification>

Where the authToken and ftpPassword are exposed in the config log.

Original References

[1] Palo Alto Networks PAN-OS Software Security Advisory: https://security.paloaltonetworks.com/PAN-SA-2024-5916

[2] PAN-OS Administrator's Guide: https://docs.paloaltonetworks.com/pan-os/10-/pan-os-admin

Mitigation and Recommendations

While there is no patch available for this vulnerability at the time of this post, we recommend following the best practices listed below to protect your sensitive data:

1. Restrict access to config logs: Limit access to the config logs to only select trusted administrators who genuinely require this access. Use the principle of least privilege to assign only essential permissions to users.

2. Monitor log access: Keep track of who accesses the config logs and when they access it. Regularly review the logs to detect any unauthorized access or suspicious activity.

3. Implement security awareness training: Educate your employees about the importance of safeguarding sensitive information. Encourage administrators to follow security policies and avoid disclosing secrets, passwords, and tokens unintentionally.

4. Stay up-to-date on security advisories: Regularly check Palo Alto Networks' security advisories and install patches as they become available to address vulnerabilities in PAN-OS software.

In conclusion, this information exposure vulnerability in Palo Alto Networks' PAN-OS software highlights the importance of proper configuration management and security awareness. Organizations must take precautions to restrict access to sensitive data and keep their networks secure.

Timeline

Published on: 08/14/2024 17:15:18 UTC
Last modified on: 08/20/2024 19:30:11 UTC