CVE-2024-5908 GlobalProtect App: Encrypted Credential Exposure via Log Files

Palo Alto Networks Security Advisories / CVE-2024-5908

CVE-2024-5908 GlobalProtect App: Encrypted Credential Exposure via Log Files

Urgency MODERATE

Severity 5.5 · MEDIUM

Response Effort MODERATE

Recovery USER

Value Density DIFFUSE

Attack Vector NETWORK

Attack Complexity LOW

Attack Requirements PRESENT

Automatable NO

User Interaction ACTIVE

Product Confidentiality LOW

Product Integrity NONE

Product Availability NONE

Privileges Required NONE

Subsequent Confidentiality HIGH

Subsequent Integrity HIGH

Subsequent Availability HIGH

NVD JSON

Published 2024-06-12

Updated 2024-08-14

Reference GPC-18597

Discovered externally

Description

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

Product Status

Versions	Affected	Unaffected
GlobalProtect App 6.2	< 6.2.3 on Windows and macOS, None on Linux	>= 6.2.3 on Windows and macOS, All on Linux
GlobalProtect App 6.1	< 6.1.3 on Windows and macOS, None on Android and iOS, < 6.1.3 on Linux	>= 6.1.3 on Windows and macOS, All on Android and iOS, >= 6.1.3 on Linux
GlobalProtect App 6.0	< 6.0.8 on Windows and macOS, All on Linux	>= 6.0.8 on Windows and macOS, None on Linux
GlobalProtect App 5.1	< 5.1.12 on Windows and macOS, All on Linux	>= 5.1.12 on Windows and macOS, None on Linux

Severity: MEDIUM

CVSSv4.0 Base Score: 5.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-532: Insertion of Sensitive Information into Log File

Solution

This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.

Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPA.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.

Acknowledgments

Palo Alto Networks thanks Denis Faiustov and Ruslan Sayfiev of GMO Cybersecurity by IERAE for discovering and reporting this issue.

Frequently Asked Questions

Q.What credentials were exposed in PanGPA.log?

GlobalProtect username and password were exposed if Radius or Local db authentication profile was used as the authentication mechanism.
LDAP username and password were exposed if LDAP was used as the authentication mechanism
Windows username and password were exposed if "User-logon (Always On)" and "Use Single Sign-on (Windows)" are enabled in the Portal > Agent > App tab settings page

Timeline

2024-08-14 Updated name of affected log file to PanGPA.log

2024-06-12 Initial publication