Palo Alto Networks Security Advisories / CVE-2024-8688

CVE-2024-8688 PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)

047910
Severity 6.7 · MEDIUM
Urgency MODERATE
Response Effort MODERATE
Recovery USER
Value Density CONCENTRATED
Attack Vector LOCAL
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction NONE
Product Confidentiality HIGH
Product Integrity NONE
Product Availability NONE
Privileges Required HIGH
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE

Description

An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewall.

Product Status

VersionsAffectedUnaffected
Cloud NGFW NoneAll
PAN-OS 11.2NoneAll
PAN-OS 11.1NoneAll
PAN-OS 11.0NoneAll
PAN-OS 10.2NoneAll
PAN-OS 10.1< 10.1.1>= 10.1.1
PAN-OS 10.0< 10.0.10>= 10.0.10
PAN-OS 9.1< 9.1.15>= 9.1.15
Prisma Access NoneAll

Severity: MEDIUM

CVSSv4.0 Base Score: 6.7 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-155 Improper Neutralization of Wildcards or Matching Symbols

Solution

This issue is fixed in PAN-OS 9.1.15, PAN-OS 10.0.10, PAN-OS 10.1.1, and all later PAN-OS versions.

Acknowledgments

Palo Alto Networks thanks Matei "Mal" Badanoiu of Deloitte and Martin Smid of Palo Alto Networks for discovering and reporting this issue.

Timeline

Initial publication
© 2024 Palo Alto Networks, Inc. All rights reserved.