Palo Alto Networks Security Advisories / CVE-2024-5921

CVE-2024-5921 GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation

Urgency MODERATE

047910
Severity 5.6 · MEDIUM
Exploit Maturity POC
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector ADJACENT
Attack Complexity LOW
Attack Requirements PRESENT
Automatable NO
User Interaction PASSIVE
Product Confidentiality NONE
Product Integrity HIGH
Product Availability NONE
Privileges Required NONE
Subsequent Confidentiality HIGH
Subsequent Integrity HIGH
Subsequent Availability HIGH

Description

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Please subscribe to our RSS feed to be alerted to new updates to this and other advisories.

Product Status

VersionsAffectedUnaffected
GlobalProtect App 6.3< 6.3.2* on Windows
< 6.3.2* on macOS
>= 6.3.2* on Windows (ETA: end of Dec)
>= 6.3.2* on macOS (ETA: end of Dec)
GlobalProtect App 6.2< 6.2.1-HF* on Linux
< 6.2.6* on Windows
< 6.2.6-HF* on macOS
>= 6.2.1-HF* on Linux (ETA: end of Dec)
>= 6.2.6* on Windows
>= 6.2.6-HF* on macOS (ETA: end of Dec)
GlobalProtect App 6.1All on Windows
All on macOS
All on Linux
All on Android
< 6.1.7* on iOS
None on Windows
None on macOS
None on Linux
None on Android
>= 6.1.7* on iOS (ETA: end of Dec)
GlobalProtect App 6.0None in FIPS-CC mode
All in FIPS-CC mode
GlobalProtect App 5.1None in FIPS-CC mode
All in FIPS-CC mode
GlobalProtect UWP AppAll
None

* In addition to the software updates listed above, additional steps are required to protect against this vulnerability. See the Solution section for full details.

Severity: MEDIUM, Suggested Urgency: MODERATE

An attacker on the same subnet as an end user who can influence DNS traffic can cause the user to connect to a malicious GlobalProtect portal.
CVSS-BT: 5.6 / CVSS-B: 7.2 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P/AU:N/R:U/V:D/RE:M/U:Amber)

A local user with non-administrative privileges connects to a malicious GlobalProtect portal.
CVSS-BT: 5.6 / CVSS-B: 7.1 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue. We are aware of a publicly available conference talk and blog posts discussing this issue. A proof of concept for this issue is also publicly available.

Weakness Type and Impact

CWE-295 Improper Certificate Validation

CAPEC-233 Privilege Escalation

Solution

This issue is fixed in GlobalProtect app 6.2.6 and all later GlobalProtect app 6.2 versions on Windows. Additional fixes are under development and will be made available for the remaining platforms (macOS, Linux, iOS, and Android).

The fix for this vulnerability requires three steps:
  1. Ensure that all of your GlobalProtect portals use TLS certificate chains that meet the criteria specified in the "FIPS-CC Certification Validation" table in our documentation.
  2. Ensure that the the TLS certificate chains used by the GlobalProtect portals are added to the root certificate store in your operating system.
  3. Install a fixed version of GlobalProtect using one of the deployment options below. This setting enforces strict X.509v3 verification checks on the certificate provided by the GlobalProtect portal.

Note: Prisma Access customers using portals with a *.gpcloudservice.com domain name already have valid TLS certificate chains. The root certificate for these portals is from GoDaddy, which is trusted by default in Windows, macOS, RHEL, Ubuntu, iOS, and Android. Therefore, Prisma Access customers using a GlobalProtect portal with a *.gpcloudservice.com domain name should only need to perform step 3 above.

Important: If your GlobalProtect portals do not use valid X.509V3 TLS certificate chains, this will result in TLS verification failures. To generate a GlobalProtect portal certificate that can be used with a fixed version of GlobalProtect app, refer to the first "FIPS-CC Certification Validation" table in our documentation.

Solution for new and existing GlobalProtect app installation on Windows

Customers can use their endpoint mobile device management (MDM) tools to apply the following changes.

  1. Install a fixed version of GlobalProtect app.
  2. Update the following registry key with the specified recommended values (these values have the REG_SZ type):
    [HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings]
    "cert-store"="machine"
    "cert-location"="ROOT"
    "full-chain-cert-verify"="yes"
  3. To apply this registry change, restart the operating system.

Alternate solution for new GlobalProtect app installation on Windows

Install the GlobalProtect app with the pre-deployment key FULLCHAINCERTVERIFY set to Yes:

msiexec.exe /i GlobalProtect64.msi FULLCHAINCERTVERIFY="yes"
Note: This command will add the registry values listed in previous section (no additional MSI options are needed).

Workarounds and Mitigations

You can mitigate this issue for all platforms (Windows, macOS, Linux, iOS, Android) by using the GlobalProtect app 6.0 in FIPS-CC mode or GlobalProtect app 5.1 in FIPS-CC mode. For details, refer to the first "FIPS-CC Certification Validation" table in our documentation.

Note: this is separate from any FIPS-CC configurations on any GlobalProtect portals or gateways. This workaround is specific to FIPS-CC mode on the GlobalProtect app. GlobalProtect portals or gateways do not need to use FIPS-CC mode as part of this workaround.

Acknowledgments

Palo Alto Networks thanks Maxime ESCOURBIAC, Michelin CERT, Yassine BENGANA, Abicom for Michelin CERT, and Richard Warren and David Cash of AmberWolf for discovering and reporting the issue.

Frequently Asked Questions

Q. What does the fix for the GlobalProtect app on Windows do?

The fix for this vulnerability adds three configuration options to the installer (CERTSTORE, CERTLOCATION, and FULLCHAINCERTVERIFY) and Windows registry (cert-store, cert-location, full-chain-cert-verify). Collectively, these options configure the GlobalProtect app to enforce strict X.509v3 verification checks on the certificate chain provided by GlobalProtect portals. In addition, FIPS-CC certificate verification checks are now performed when connecting to GlobalProtect portals.

Note: Documentation for the new installer options and registry settings will be published to the Deploy App Settings to Windows Endpoints documentation.

Q. How do I troubleshoot issues with my TLS certificates?

Refer to the first "FIPS-CC Certification Validation" table in our documentation.

Q. I use client-based certificate authentication. Am I affected?

This is unrelated to client certificate authentication. This vulnerability is related to the TLS server certificate presented by the GlobalProtect portal.

Q. If I set "Allow User to Change Portal Address" in the GlobalProtect portal settings to "No", is that a valid workaround?

No. This vulnerability can be exploited by an attacker who is not on the user's system. An attacker on the same subnet as a target user can influence DNS traffic on the subnet, causing the GlobalProtect app on the user's system to connect to a malicious GlobalProtect portal.

Q. Can I use FIPS-CC in a version of the GlobalProtect app other than GlobalProtect app 5.1 or GlobalProtect app 6.0?

No. FIPS-CC is only certified for GlobalProtect app 5.1 and GlobalProtect app 6.0. A prior version of this advisory indicated that this was possible for versions other than GlobalProtect app 5.1 and GlobalProtect app 6.0. This has been corrected.

Q. I already installed GlobalProtect app 6.2.6 on Windows without the special MSI command line options. Do I have to re-install?

No. Refer to the "Solution for new and existing GlobalProtect app installation on Windows" section for guidance on registry updates that you can apply after installing GlobalProtect app 6.2.6 on Windows.

Q. How do I know if I ran the MSI installer correctly?

After installing, check the Windows registry under the HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings key. If full-chain-cert-verify is set to "yes", the installer was run correctly.

Note: Documentation for the new installer options and registry settings will be published to the Deploy App Settings to Windows Endpoints documentation.

Q. If I'm using self-signed certificates in my GlobalProtect portals, will the GlobalProtect app still be affected?

Yes. A software update listed in the Solution section is still required. If the self-signed certificate meets the criteria specified in the "FIPS-CC Certification Validation" table in our documentation, the self-signed certificate will be validated.

Timeline

Updated affected products, added ETAs, clarified solution, and added frequently asked questions
Added registry-based deployment option to solution, and added frequently asked questions
Clarified impact, solution, and added frequently asked questions
Initial publication
© 2024 Palo Alto Networks, Inc. All rights reserved.