Palo Alto Networks Security Advisories / CVE-2023-0008

CVE-2023-0008 PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface

047910
Severity 4.4 · MEDIUM
Attack Vector NETWORK
Scope UNCHANGED
Attack Complexity HIGH
Confidentiality Impact HIGH
Privileges Required HIGH
Integrity Impact NONE
User Interaction NONE
Availability Impact NONE

Description

A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.

Product Status

VersionsAffectedUnaffected
Cloud NGFW NoneAll
PAN-OS 11.0< 11.0.1>= 11.0.1
PAN-OS 10.2< 10.2.4>= 10.2.4
PAN-OS 10.1< 10.1.10>= 10.1.10
PAN-OS 10.0< 10.0.12>= 10.0.12
PAN-OS 9.1< 9.1.16>= 9.1.16
PAN-OS 9.0< 9.0.17>= 9.0.17
PAN-OS 8.1< 8.1.25>= 8.1.25
Prisma Access NoneAll

Severity: MEDIUM

CVSSv3.1 Base Score: 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-73: External Control of File Name or Path

Solution

This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.10, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions.

Workarounds and Mitigations

This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices.

Acknowledgments

Palo Alto Networks thanks Alex Hordijk for discovering and reporting this issue.

Timeline

Clarified that the administrator must have read-write privileges
Initial publication
© 2024 Palo Alto Networks, Inc. All rights reserved.