CVE-2017-9458 XML External Entity (XXE) in PAN-OS

Palo Alto Networks Security Advisories / CVE-2017-9458

CVE-2017-9458 XML External Entity (XXE) in PAN-OS

Severity 9.8 · CRITICAL

Attack Vector NETWORK

Scope UNCHANGED

Attack Complexity LOW

Confidentiality Impact HIGH

Privileges Required NONE

Integrity Impact HIGH

User Interaction NONE

Availability Impact HIGH

CVE JSON

Published 2017-08-30

Updated 2017-08-30

Reference PAN-75688, PAN-SA-2017-0024

Description

A vulnerability exists in PAN-OS’s GlobalProtect internal and external gateway interface that could allow for XML External Entity (XXE) attack. PAN-OS does not properly parse XML input. (Ref # PAN-75688 / CVE-2017-9458)

Successful exploitation of this issue may allow disclosure of information, denial of service or server side request forgery.

This issue affects PAN-OS 6.1.17 and earlier, PAN-OS 7.0.16 and earlier, PAN-OS 7.1.11 and earlier, PAN-OS 8.0.2 and earlier

Product Status

Versions	Affected	Unaffected
PAN-OS 8.0	<= 8.0.2	>= 8.0.3
PAN-OS 7.1	<= 7.1.11	>= 7.1.12
PAN-OS 7.0	<= 7.0.16	>= 7.0.17
PAN-OS 6.1	<= 6.1.17	>= 6.1.18

Severity: CRITICAL

CVSSv3.0 Base Score: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-611 Improper Restriction of XML External Entity Reference

Solution

PAN-OS 6.1.18 and later, PAN-OS 7.0.17 and later, PAN-OS 7.1.12 and later, PAN-OS 8.0.3 and later

Workarounds and Mitigations

Customers that have not configured GlobalProtect are not affected by this issue.

Acknowledgments

Palo Alto Networks would like to thank Alejandro Iacobelli and Nicolas Videla from Mercadolibre for reporting (CVE-2017-9458).