Description
该漏洞是由于PAN-OS中Nginx/Apache对路径的处理不同导致的。未经授权的攻击者可以利用这一漏洞绕过系统身份验证直接访问Web界面从而造成敏感数据泄露或系统被接管等更大的危害。
Palo Alto Networks PAN-OS 身份验证绕过漏洞(CVE-2025-0108)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://security.paloaltonetworks.com/CVE-2025-0108
https://nvd.nist.gov/vuln/detail/CVE-2025-0108
https://github.com/iSee857/CVE-2025-0108-PoC
https://www.secrss.com/articles/75569
https://blog.csdn.net/yuanlirong22/article/details/145726928
https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/
https://www.assetnote.io/resources/research/nginx-apache-path-confusion-to-auth-bypass-in-pan-os
https://cloud.tencent.com/developer/article/2621847
https://www.venustech.com.cn/new_type/aqtg/20250213/28331.html
https://www.anquanke.com/post/id/304519
https://cn-sec.com/archives/3736455.html
https://www.greynoise.io/blog/greynoise-observes-active-exploitation-of-pan-os-authentication-bypass-vulnerability-cve-2025-0108
https://arcticwolf.com/resources/blog/cve-2025-0108/
https://fortiguard.fortinet.com/threat-signal-report/6019
https://www.rapid7.com/db/vulnerabilities/palo-alto-networks-pan-os-cve-2025-0108/