Palo Alto Networks Security Advisories / CVE-2025-0123

CVE-2025-0123 PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures

Description

A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature in decrypted HTTP/2 data streams traversing network interfaces on the firewall. HTTP/1.1 data streams are not impacted.

In normal conditions, decrypted packet captures are available to firewall administrators after they obtain and install a free Decryption Port Mirror license. The license requirement ensures that this feature can only be used after approved personnel purposefully activate the license. For more information, review how to configure decryption port mirroring.

The administrator must obtain network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. Risk of this issue can be greatly reduced by restricting access to the management interface to only trusted administrators and from only internal IP addresses according to our recommended critical deployment guidelines.

Customer firewall administrators do not have access to the packet capture feature in Cloud NGFW. This feature is available only to authorized Palo Alto Networks personnel permitted to perform troubleshooting.

Prisma® Access is not impacted by this vulnerability.

Product Status

Versions	Affected	Unaffected
Cloud NGFW	None	All
PAN-OS 11.2	< 11.2.6	>= 11.2.6
PAN-OS 11.1	< 11.1.8	>= 11.1.8
PAN-OS 10.2	< 10.2.15	>= 10.2.15 (ETA: 05/15)
PAN-OS 10.1	< 10.1.14-h13	>= 10.1.14-h13
Prisma Access	None	All

Please note that PAN-OS 11.0, PAN-OS 10.0, PAN-OS 9.1, PAN-OS 9.0, and earlier PAN-OS versions have reached their software end-of-life (EoL) dates and are no longer evaluated for vulnerabilities so we do not plan to fix this issue in these EoL versions. You should presume that these versions are affected.

Required Configuration for Exposure

This vulnerability requires the following configuration:

1. An SSL decryption policy matching HTTP/2 data flows tied to a decryption profile without 'Strip ALPN' enabled;
   and
2. Global HTTP/2 inspection enabled.
   
   Note: Global HTTP/2 inspection is enabled by default. The setting to disable it is available only by using the PAN-OS command-line interface (CLI). To verify whether this feature is globally disabled use the following CLI commands:

   > set cli config-output-format set
   > configure
   # show | match 'http2 enable no'

     - If there is no output, then http2 inspection is enabled.
     - If output shows 'set deviceconfig setting http2 enable no' then http2 traffic is classified as unknown-tcp and is not decrypted by the firewall, which makes clear-text data unreadable in packet captures.
     
   

Severity: LOW, Suggested Urgency: MODERATE

Firewall administrators can see traffic that they should not be able to see, which impacts confidentiality but there is no impact to integrity or availability of that traffic.
LOW - CVSS-BT: 1.9 /CVSS-B: 5.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber)

There is no risk if the firewall is licensed for decryption port mirroring because firewall administrators are already authorized to obtain decrypted packet captures from Palo Alto Networks firewalls.
NONE - CVSS-BT: 0.0 /CVSS-B: 0.0 (CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/U:Clear)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-312 Cleartext Storage of Sensitive Information

CAPEC-158: Sniffing Network Traffic

Solution

This issue is fixed in PAN-OS 10.1.14-h13, PAN-OS 10.2.15, PAN-OS 11.1.8, PAN-OS 11.2.6, and all later PAN-OS versions.

Version	Minor Version	Suggested Solution
PAN-OS 11.2	11.2.0 through 11.2.5	Upgrade to 11.2.6 or later.
PAN-OS 11.1	11.1.0 through 11.1.7	Upgrade to 11.1.8 or later.
PAN-OS 11.0 (EoL)		Upgrade to a supported fixed version.
PAN-OS 10.2	10.2.0 through 10.2.14	Upgrade to 10.2.15 or later.
PAN-OS 10.1	10.1.0 through 10.1.14-h11	Upgrade to 10.1.14-h13 or later.
All other older unsupported PAN-OS versions		Upgrade to a supported fixed version.

To fully remediate risk, you must delete all pre-existing packet capture files stored on the firewall after you upgrade to a fixed PAN-OS version. This task can be performed through the PAN-OS web interface or through the PAN-OS CLI.

Using the Web Interface:

1. Select Monitor > Packet Capture > Captured Files > (Select All) and Delete the files.


2. Select Yes when prompted by the confirmation dialog.

Using the PAN-OS CLI:

1. Enter the following operational command:

> delete debug-filter file * 

2. A confirmation prints to the terminal and indicates that all packet capture files were successfully deleted from the firewall:

successfully removed * 

Workarounds and Mitigations

Mitigation: In a Palo Alto Networks firewall, you can configure the decryption profile to strip ALPN (Application-Layer Protocol Negotiation) from the TLS handshake, which is used to negotiate the application protocol (e.g., HTTP/2 or HTTP/1.1) for the secured connection. When ALPN is absent, the following behaviors can occur:

• Firewall behavior—With no ALPN value available, the firewall cannot perform HTTP/2 inspection. It either forces the connection to downgrade to HTTP/1.1 (by letting the client and server negotiate a fallback) or, if that downgrade isn’t possible, it can classify the traffic as unknown-tcp and potentially affects your security policy rules and application identification.
• Client behavior—Most modern web browsers rely on ALPN to negotiate HTTP/2. If ALPN is missing, the client typically falls back to HTTP/1.1.
• Server behavior—If ALPN is absent, the server can assume that the client supports only HTTP/1.1 and downgrades the connection accordingly. If the server enforces HTTP/2-only connections, then it may reject the handshake and cause a connection failure.

Consequently, without ALPN, the Palo Alto Networks firewall does not inspect HTTP/2 connections, which prevents decrypted HTTP/2 (clear-text) traffic exposure to firewall administrators.

You can review how to strip ALPN and disable HTTP/2 inspection for targeted traffic in the App-ID and HTTP/2 inspection technical documentation.

Additional mitigation: The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our critical deployment guidelines. Specifically, you should restrict management interface access to only trusted internal IP addresses.

Review information about how to secure management access to your Palo Alto Networks firewalls:

• Palo Alto Networks LIVEcommunity article: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-ac...
• Palo Alto Networks official and detailed technical documentation: https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administr...

Acknowledgments

CPEs

Timeline